Remove the old migration tool and document the new one (#4447)
This commit is contained in:
Quentin Gliech
@@ -3,7 +3,6 @@ crates/*/target
|
||||
crates/*/node_modules
|
||||
frontend/node_modules
|
||||
frontend/dist
|
||||
tools/syn2mas/**
|
||||
docs/
|
||||
.devcontainer/
|
||||
.github/
|
||||
|
||||
17
.github/dependabot.yml
vendored
17
.github/dependabot.yml
vendored
@@ -106,20 +106,3 @@ updates:
|
||||
browser-logos:
|
||||
patterns:
|
||||
- "@browser-logos/*"
|
||||
|
||||
- package-ecosystem: "npm"
|
||||
directory: "/tools/syn2mas/"
|
||||
labels:
|
||||
- "A-Dependencies"
|
||||
- "Z-Deps-Syn2Mas"
|
||||
schedule:
|
||||
interval: "weekly"
|
||||
ignore:
|
||||
# Ignore @types/node until we can upgrade to Node 20
|
||||
- dependency-name: "@types/node"
|
||||
update-types: ["version-update:semver-major"]
|
||||
groups:
|
||||
production:
|
||||
dependency-type: "production"
|
||||
development:
|
||||
dependency-type: "development"
|
||||
|
||||
7
.github/scripts/commit-and-tag.cjs
vendored
7
.github/scripts/commit-and-tag.cjs
vendored
@@ -13,12 +13,7 @@ module.exports = async ({ github, context }) => {
|
||||
const parent = context.sha;
|
||||
if (!version) throw new Error("VERSION is not defined");
|
||||
|
||||
const files = [
|
||||
"Cargo.toml",
|
||||
"Cargo.lock",
|
||||
"tools/syn2mas/package.json",
|
||||
"tools/syn2mas/package-lock.json",
|
||||
];
|
||||
const files = ["Cargo.toml", "Cargo.lock"];
|
||||
|
||||
/** @type {{path: string, mode: "100644", type: "blob", sha: string}[]} */
|
||||
const tree = [];
|
||||
|
||||
63
.github/workflows/build.yaml
vendored
63
.github/workflows/build.yaml
vendored
@@ -23,7 +23,6 @@ env:
|
||||
SCCACHE_GHA_ENABLED: "true"
|
||||
RUSTC_WRAPPER: "sccache"
|
||||
IMAGE: ghcr.io/element-hq/matrix-authentication-service
|
||||
IMAGE_SYN2MAS: ghcr.io/element-hq/matrix-authentication-service/syn2mas
|
||||
BUILDCACHE: ghcr.io/element-hq/matrix-authentication-service/buildcache
|
||||
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
|
||||
|
||||
@@ -253,22 +252,6 @@ jobs:
|
||||
type=semver,pattern={{major}}
|
||||
type=sha
|
||||
|
||||
- name: Docker meta (syn2mas)
|
||||
id: meta-syn2mas
|
||||
uses: docker/metadata-action@v5.7.0
|
||||
with:
|
||||
images: "${{ env.IMAGE_SYN2MAS }}"
|
||||
bake-target: docker-metadata-action-syn2mas
|
||||
flavor: |
|
||||
latest=auto
|
||||
tags: |
|
||||
type=ref,event=branch
|
||||
type=ref,event=pr
|
||||
type=semver,pattern={{version}}
|
||||
type=semver,pattern={{major}}.{{minor}}
|
||||
type=semver,pattern={{major}}
|
||||
type=sha
|
||||
|
||||
- name: Setup Cosign
|
||||
uses: sigstore/cosign-installer@v3.8.2
|
||||
|
||||
@@ -294,7 +277,6 @@ jobs:
|
||||
./docker-bake.hcl
|
||||
cwd://${{ steps.meta.outputs.bake-file }}
|
||||
cwd://${{ steps.meta-debug.outputs.bake-file }}
|
||||
cwd://${{ steps.meta-syn2mas.outputs.bake-file }}
|
||||
set: |
|
||||
base.output=type=image,push=true
|
||||
base.cache-from=type=registry,ref=${{ env.BUILDCACHE }}:buildcache
|
||||
@@ -318,43 +300,11 @@ jobs:
|
||||
env:
|
||||
REGULAR_DIGEST: ${{ steps.output.outputs.metadata && fromJSON(steps.output.outputs.metadata).regular.digest }}
|
||||
DEBUG_DIGEST: ${{ steps.output.outputs.metadata && fromJSON(steps.output.outputs.metadata).debug.digest }}
|
||||
SYN2MAS_DIGEST: ${{ steps.output.outputs.metadata && fromJSON(steps.output.outputs.metadata).syn2mas.digest }}
|
||||
|
||||
run: |-
|
||||
cosign sign --yes \
|
||||
"$IMAGE@$REGULAR_DIGEST" \
|
||||
"$IMAGE@$DEBUG_DIGEST" \
|
||||
"$IMAGE_SYN2MAS@$SYN2MAS_DIGEST"
|
||||
|
||||
syn2mas:
|
||||
name: Release syn2mas on NPM
|
||||
runs-on: ubuntu-24.04
|
||||
if: github.event_name != 'pull_request'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write
|
||||
|
||||
steps:
|
||||
- name: Checkout the code
|
||||
uses: actions/checkout@v4.2.2
|
||||
|
||||
- name: Install Node
|
||||
uses: actions/setup-node@v4.4.0
|
||||
with:
|
||||
node-version-file: ./tools/syn2mas/.nvmrc
|
||||
|
||||
- name: Install Node dependencies
|
||||
working-directory: ./tools/syn2mas
|
||||
run: npm ci
|
||||
|
||||
- name: Publish
|
||||
uses: JS-DevTools/npm-publish@v3
|
||||
with:
|
||||
package: ./tools/syn2mas
|
||||
token: ${{ secrets.NPM_TOKEN }}
|
||||
provenance: true
|
||||
dry-run: ${{ !startsWith(github.ref, 'refs/tags/') }}
|
||||
|
||||
release:
|
||||
name: Release
|
||||
@@ -363,7 +313,6 @@ jobs:
|
||||
needs:
|
||||
- assemble-archives
|
||||
- build-image
|
||||
- syn2mas
|
||||
steps:
|
||||
- name: Download the artifacts from the previous job
|
||||
uses: actions/download-artifact@v4
|
||||
@@ -403,18 +352,6 @@ jobs:
|
||||
') }}
|
||||
```
|
||||
|
||||
`syn2mas` migration tool:
|
||||
|
||||
- Digest:
|
||||
```
|
||||
${{ env.IMAGE_SYN2MAS }}@${{ fromJSON(needs.build-image.outputs.metadata).syn2mas.digest }}
|
||||
```
|
||||
- Tags:
|
||||
```
|
||||
${{ join(fromJSON(needs.build-image.outputs.metadata).syn2mas.tags, '
|
||||
') }}
|
||||
```
|
||||
|
||||
files: |
|
||||
artifacts/mas-cli-aarch64-linux.tar.gz
|
||||
artifacts/mas-cli-x86_64-linux.tar.gz
|
||||
|
||||
29
.github/workflows/ci.yaml
vendored
29
.github/workflows/ci.yaml
vendored
@@ -311,34 +311,6 @@ jobs:
|
||||
--archive-file nextest-archive.tar.zst \
|
||||
--partition count:${{ matrix.partition }}/3
|
||||
|
||||
syn2mas:
|
||||
name: Check syn2mas
|
||||
runs-on: ubuntu-24.04
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
steps:
|
||||
- name: Checkout the code
|
||||
uses: actions/checkout@v4.2.2
|
||||
|
||||
- name: Install Node
|
||||
uses: actions/setup-node@v4.4.0
|
||||
with:
|
||||
node-version-file: ./tools/syn2mas/.nvmrc
|
||||
|
||||
- name: Install Node dependencies
|
||||
working-directory: ./tools/syn2mas
|
||||
run: npm ci
|
||||
|
||||
- name: Lint
|
||||
working-directory: ./tools/syn2mas
|
||||
run: npm run lint
|
||||
|
||||
- name: Build
|
||||
working-directory: ./tools/syn2mas
|
||||
run: npm run build
|
||||
|
||||
tests-done:
|
||||
name: Tests done
|
||||
if: ${{ always() }}
|
||||
@@ -352,7 +324,6 @@ jobs:
|
||||
- clippy
|
||||
- check-schema
|
||||
- test
|
||||
- syn2mas
|
||||
runs-on: ubuntu-24.04
|
||||
|
||||
steps:
|
||||
|
||||
4
.github/workflows/tag.yaml
vendored
4
.github/workflows/tag.yaml
vendored
@@ -40,10 +40,6 @@ jobs:
|
||||
- name: Run `cargo metadata` to make sure the lockfile is up to date
|
||||
run: cargo metadata --format-version 1
|
||||
|
||||
- name: Set the tools/syn2mas version
|
||||
working-directory: tools/syn2mas
|
||||
run: npm version "${{ inputs.version }}" --no-git-tag-version
|
||||
|
||||
- name: Commit and tag using the GitHub API
|
||||
uses: actions/github-script@v7.0.1
|
||||
id: commit
|
||||
|
||||
@@ -21,7 +21,6 @@
|
||||
"frontend/.storybook/locales.ts",
|
||||
"frontend/.storybook/public/mockServiceWorker.js",
|
||||
"frontend/locales/*.json",
|
||||
"tools/syn2mas/package.json",
|
||||
"**/coverage/**",
|
||||
"**/dist/**"
|
||||
]
|
||||
|
||||
@@ -4,12 +4,11 @@
|
||||
variable "VERGEN_GIT_DESCRIBE" {}
|
||||
|
||||
// This is what is baked by GitHub Actions
|
||||
group "default" { targets = ["regular", "debug", "syn2mas"] }
|
||||
group "default" { targets = ["regular", "debug"] }
|
||||
|
||||
// Targets filled by GitHub Actions: one for the regular tag, one for the debug tag
|
||||
target "docker-metadata-action" {}
|
||||
target "docker-metadata-action-debug" {}
|
||||
target "docker-metadata-action-syn2mas" {}
|
||||
|
||||
// This sets the platforms and is further extended by GitHub Actions to set the
|
||||
// output and the cache locations
|
||||
@@ -37,8 +36,3 @@ target "debug" {
|
||||
inherits = ["base", "docker-metadata-action-debug"]
|
||||
target = "debug"
|
||||
}
|
||||
|
||||
target "syn2mas" {
|
||||
inherits = ["base", "docker-metadata-action-syn2mas"]
|
||||
context = "./tools/syn2mas"
|
||||
}
|
||||
|
||||
@@ -12,7 +12,6 @@
|
||||
- [Database setup](./setup/database.md)
|
||||
- [Homeserver configuration](./setup/homeserver.md)
|
||||
- [Configuring a reverse proxy](./setup/reverse-proxy.md)
|
||||
- [Configuring .well-known](./setup/well-known.md)
|
||||
- [Configure an upstream SSO provider](./setup/sso.md)
|
||||
- [Running the service](./setup/running.md)
|
||||
- [Migrating an existing homeserver](./setup/migration.md)
|
||||
@@ -33,6 +32,7 @@
|
||||
- [`database`](./reference/cli/database.md)
|
||||
- [`manage`](./reference/cli/manage.md)
|
||||
- [`server`](./reference/cli/server.md)
|
||||
- [`syn2mas`](./reference/cli/syn2mas.md)
|
||||
- [`worker`](./reference/cli/worker.md)
|
||||
- [`templates`](./reference/cli/templates.md)
|
||||
- [`doctor`](./reference/cli/doctor.md)
|
||||
|
||||
@@ -26,7 +26,7 @@ clients:
|
||||
# ...
|
||||
```
|
||||
|
||||
## `config generate`
|
||||
## `config generate [--synapse-config <synapse-config>] [--output <output>]`
|
||||
|
||||
Generate a sample configuration file.
|
||||
It generates random signing keys (`.secrets.keys`) and the cookie encryption secret (`.secrets.encryption`).
|
||||
@@ -38,6 +38,10 @@ INFO generate:rsa: mas_config::oauth2: Done generating RSA key
|
||||
INFO generate:ecdsa: mas_config::oauth2: Done generating ECDSA key
|
||||
```
|
||||
|
||||
The `--synapse-config` option can be used to migrate over configuration options from an existing Synapse configuration.
|
||||
|
||||
The `--output` option can be used to specify the output file. If not specified, the output will be written to stdout.
|
||||
|
||||
## `config sync [--prune] [--dry-run]`
|
||||
|
||||
Synchronize the configuration with the database.
|
||||
@@ -52,4 +56,4 @@ INFO cli.config.sync: Updating provider provider.id=01H3FDH2XZJS8ADKRGWM84PZTY
|
||||
INFO cli.config.sync: Adding provider provider.id=01H3FDH2XZJS8ADKRGWM84PZTF
|
||||
INFO cli.config.sync: Deleting client client.id=01GFWRB9MYE0QYK60NZP2YF905
|
||||
INFO cli.config.sync: Updating client client.id=01GFWRB9MYE0QYK60NZP2YF904
|
||||
```
|
||||
```
|
||||
|
||||
29
docs/reference/cli/syn2mas.md
Normal file
29
docs/reference/cli/syn2mas.md
Normal file
@@ -0,0 +1,29 @@
|
||||
# `syn2mas`
|
||||
|
||||
Tool to import data from an existing Synapse homeserver into MAS.
|
||||
|
||||
Global options:
|
||||
- `--config <config>`: Path to the MAS configuration file.
|
||||
- `--help`: Print help.
|
||||
- `--synapse-config <synapse-config>`: Path to the Synapse configuration file.
|
||||
- `--synapse-database-uri <synapse-database-uri>`: Override the Synapse database URI.
|
||||
|
||||
## `syn2mas check`
|
||||
|
||||
Check the setup for potential problems before running a migration
|
||||
|
||||
```console
|
||||
$ mas-cli syn2mas check --config mas_config.yaml --synapse-config homeserver.yaml
|
||||
```
|
||||
|
||||
## `syn2mas migrate [--dry-run]`
|
||||
|
||||
Migrate data from the homeserver to MAS.
|
||||
|
||||
The `--dry-run` option will perform a dry-run of the migration, which is safe to run without stopping Synapse.
|
||||
It will perform a full data migration, but then empty the MAS database at the end to roll back.
|
||||
|
||||
|
||||
```console
|
||||
$ mas-cli syn2mas migrate --config mas_config.yaml --synapse-config homeserver.yaml
|
||||
```
|
||||
@@ -11,43 +11,11 @@ The authentication service becomes the source of truth for user accounts and acc
|
||||
At time of writing, the authentication service is meant to be run on a standalone domain name (e.g. `auth.example.com`), and the homeserver on another (e.g. `matrix.example.com`).
|
||||
This domain will be user-facing as part of the authentication flow.
|
||||
|
||||
When a client initiates an authentication flow, it will discover the authentication service through the deployment `.well-known/matrix/client` endpoint.
|
||||
This file will refer to an `issuer`, which is the canonical name of the authentication service instance.
|
||||
Out of that issuer, it will discover the rest of the endpoints by calling the `[issuer]/.well-known/openid-configuration` endpoint.
|
||||
By default, the `issuer` will match the root domain where the service is deployed (e.g. `https://auth.example.com/`), but it can be configured to be different.
|
||||
|
||||
An example setup could look like this:
|
||||
|
||||
- The deployment domain is `example.com`, so Matrix IDs look like `@user:example.com`
|
||||
- The issuer chosen is `https://auth.example.com/`
|
||||
- The homeserver is deployed on `matrix.example.com`
|
||||
- The authentication service is deployed on `auth.example.com`
|
||||
- Calling `https://example.com/.well-known/matrix/client` returns the following JSON:
|
||||
|
||||
```json
|
||||
{
|
||||
"m.homeserver": {
|
||||
"base_url": "https://matrix.example.com"
|
||||
},
|
||||
"org.matrix.msc2965.authentication": {
|
||||
"issuer": "https://auth.example.com/",
|
||||
"account": "https://auth.example.com/account"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
- Calling `https://auth.example.com/.well-known/openid-configuration` returns a JSON document similar to the following:
|
||||
|
||||
```json
|
||||
{
|
||||
"issuer": "https://auth.example.com/",
|
||||
"authorization_endpoint": "https://auth.example.com/authorize",
|
||||
"token_endpoint": "https://auth.example.com/oauth2/token",
|
||||
"jwks_uri": "https://auth.example.com/oauth2/keys.json",
|
||||
"registration_endpoint": "https://auth.example.com/oauth2/registration",
|
||||
"//": "..."
|
||||
}
|
||||
```
|
||||
- The homeserver is deployed on `matrix.example.com`
|
||||
|
||||
With the installation planned, it is time to go through the installation and configuration process.
|
||||
The first section focuses on [installing the service](./installation.md).
|
||||
|
||||
@@ -1,51 +1,54 @@
|
||||
# Migrating an existing homeserver
|
||||
|
||||
One of the design goals of MAS has been to allow it to be used to migrate an existing homeserver to an OIDC-based architecture.
|
||||
One of the design goals of MAS has been to allow it to be used to migrate an existing homeserver, specifically without requiring users to re-authenticate and ensuring that all existing clients continue to work.
|
||||
|
||||
Specifically without requiring users to re-authenticate and that non-OIDC clients continue to work.
|
||||
|
||||
Features that are provided to support this include:
|
||||
Features that support this include:
|
||||
|
||||
- Ability to import existing password hashes from Synapse
|
||||
- Ability to import existing sessions and devices
|
||||
- Ability to import existing access tokens linked to devices (ie not including short-lived admin puppeted access tokens)
|
||||
- Ability to import existing access tokens
|
||||
- Ability to import existing upstream IdP subject ID mappings
|
||||
- Provides a compatibility layer for legacy Matrix authentication
|
||||
|
||||
There will be tools to help with the migration process itself. But these aren't quite ready yet.
|
||||
|
||||
## Preparing for the migration
|
||||
|
||||
The deployment is non-trivial so it is important to read through and understand the steps involved and make a plan before starting.
|
||||
The deployment is non-trivial, so it is important to read through and understand the steps involved and make a plan before starting.
|
||||
|
||||
### Get `syn2mas`
|
||||
### Is your setup ready to be migrated?
|
||||
|
||||
The easiest way to get `syn2mas` is through [`npm`](https://www.npmjs.com/package/@vector-im/syn2mas):
|
||||
#### SAML2 and LDAP Single Sign-On Providers are not supported
|
||||
|
||||
```sh
|
||||
npm install -g @vector-im/syn2mas
|
||||
```
|
||||
A deployment that requires SAML or LDAP-based authentication should use a service like [Dex](https://github.com/dexidp/dex) to bridge between the SAML provider and the authentication service.
|
||||
MAS differs from Synapse in that it does **not** have built-in support for SAML or LDAP-based providers.
|
||||
|
||||
### Run the migration advisor
|
||||
#### Custom password providers are not supported
|
||||
|
||||
You can use the advisor mode of the `syn2mas` tool to identify extra configuration steps or issues with the configuration of the homeserver.
|
||||
If your Synapse homeserver currently uses a custom password provider module, please note that MAS does not support these.
|
||||
|
||||
```sh
|
||||
syn2mas --command=advisor --synapseConfigFile=homeserver.yaml
|
||||
```
|
||||
#### SQLite databases are not supported
|
||||
|
||||
This will output `WARN` entries for any identified actions and `ERROR` entries in the case of any issues that will prevent the migration from working.
|
||||
It is worth noting that MAS currently only supports PostgreSQL as a database backend.
|
||||
The migration tool only supports reading from PostgreSQL for the Synapse database as well.
|
||||
|
||||
### Install and configure MAS alongside your existing homeserver
|
||||
|
||||
Follow the instructions in the [installation guide](installation.md) to install MAS alongside your existing homeserver.
|
||||
|
||||
You'll need a blank PostgreSQL database for MAS to use; it does not share the database with the homeserver.
|
||||
|
||||
MAS provides a tool to generate a configuration file based on your existing Synapse configuration. This is useful for kickstarting your new configuration.
|
||||
|
||||
```sh
|
||||
mas-cli config generate --synapse-config homeserver.yaml --output mas_config.yaml
|
||||
```
|
||||
|
||||
When using this tool, be careful to examine the log output for any warnings about unsupported configuration options.
|
||||
|
||||
#### Local passwords
|
||||
|
||||
Synapse uses bcrypt as its password hashing scheme while MAS defaults to using the newer argon2id.
|
||||
Synapse uses bcrypt as its password hashing scheme, while MAS defaults to using the newer argon2id.
|
||||
You will have to configure the version 1 scheme as bcrypt for migrated passwords to work.
|
||||
It is also recommended that you keep argon2id as version 2 so that once users log in, their hashes will be updated to the newer recommended scheme.
|
||||
If you have a `pepper` set in the `password_config` section of your Synapse config, then you need to specify this `pepper` as the `secret` field for your `bcrypt` scheme.
|
||||
It is also recommended that you keep argon2id as version 2 so that once users log in, their hashes will be updated to the newer, recommended scheme.
|
||||
|
||||
Example passwords configuration:
|
||||
```yml
|
||||
@@ -60,57 +63,143 @@ passwords:
|
||||
algorithm: argon2id
|
||||
```
|
||||
|
||||
If you have a pepper configured in your Synapse password configuration, you'll need to match that on version 1 of the equivalent MAS configuration.
|
||||
|
||||
The migration checker will inform you if this has not been configured properly.
|
||||
|
||||
### Map any upstream SSO providers
|
||||
|
||||
If you are using an upstream SSO provider then you will need to provision the upstream provide in MAS manually.
|
||||
If you are using an upstream SSO provider, then you will need to configure the upstream provider in MAS manually.
|
||||
|
||||
Each upstream provider will need to be given as an `--upstreamProviderMapping` command line option to the import tool.
|
||||
MAS does not support SAML or LDAP upstream providers.
|
||||
If you are using one of these, you will need to use an adapter such as Dex at this time, but we have not yet documented this procedure.
|
||||
|
||||
### Prepare the MAS database
|
||||
Each upstream provider that was used by at least one user in Synapse will need to be configured in MAS.
|
||||
|
||||
Once the database is created, it still needs to have its schema created and synced with the configuration.
|
||||
This can be done with the following command:
|
||||
Set the `synapse_idp_id` attribute on the provider to:
|
||||
|
||||
```sh
|
||||
mas-cli config sync
|
||||
- `"oidc"` if you used an OIDC provider in Synapse's legacy `oidc_config` configuration section.
|
||||
- `"oidc-myprovider"` if you used an OIDC provider in Synapse's `oidc_providers` configuration list, with a `provider` of `"myprovider"`.
|
||||
(This is because Synapse prefixes the provider ID with `oidc-` internally.)
|
||||
|
||||
Without the `synapse_idp_id`s being set, `mas-cli syn2mas` does not understand which providers in Synapse correspond to which provider in MAS.
|
||||
|
||||
For example, if your Synapse configuration looked like this:
|
||||
|
||||
```yaml
|
||||
oidc_providers:
|
||||
- idp_id: dex
|
||||
idp_name: "My Dex server"
|
||||
issuer: "https://example.com/dex"
|
||||
client_id: "synapse"
|
||||
client_secret: "supersecret"
|
||||
scopes: ["openid", "profile", "email"]
|
||||
user_mapping_provider:
|
||||
config:
|
||||
localpart_template: "{{ user.email.split('@')[0].lower() }}"
|
||||
email_template: "{{ user.email }}"
|
||||
display_name_template: "{{ user.name|capitalize }}"
|
||||
```
|
||||
|
||||
### Do a dry-run of the import to test
|
||||
Then the equivalent configuration in MAS would look like this:
|
||||
|
||||
```sh
|
||||
syn2mas --command migrate --synapseConfigFile homeserver.yaml --masConfigFile config.yaml --dryRun
|
||||
```yaml
|
||||
upstream_oauth2:
|
||||
providers:
|
||||
- id: 01JSHPZHAXC50QBKH67MH33TNF
|
||||
synapse_idp_id: oidc-dex
|
||||
issuer: "https://example.com/dex"
|
||||
human_name: "My Dex server"
|
||||
client_id: "synapse"
|
||||
client_secret: "supersecret"
|
||||
token_endpoint_auth_method: client_secret_basic
|
||||
scope: "email openid profile"
|
||||
claims_imports:
|
||||
localpart:
|
||||
action: require
|
||||
template: "{{ user.email.split('@')[0].lower() }}"
|
||||
displayname:
|
||||
action: force
|
||||
template: "{{ user.name|capitalize }}"
|
||||
email:
|
||||
action: force
|
||||
template: "{{ user.email }}"
|
||||
```
|
||||
|
||||
If no errors are reported then you can proceed to the next step.
|
||||
The migration checker will inform you if a provider is missing from MAS' config.
|
||||
|
||||
### Run the migration checker
|
||||
|
||||
You can use the `check` command of the `syn2mas` tool to identify configuration problems before starting the migration.
|
||||
You do not need to stop Synapse to run this command.
|
||||
|
||||
```sh
|
||||
mas-cli syn2mas check --config mas_config.yaml --synapse-config homeserver.yaml
|
||||
```
|
||||
|
||||
This may output a list of errors and warnings.
|
||||
|
||||
If you have any errors, you must resolve them before starting the migration.
|
||||
|
||||
If you have any warnings, please read and understand them, and possibly resolve them.
|
||||
Resolving warnings is not strictly required before starting the migration.
|
||||
|
||||
### Run the migration in test mode (dry-run)
|
||||
|
||||
MAS can perform a dry-run of the import, which is safe to run without stopping Synapse.
|
||||
It will perform a full data migration but then empty the MAS database at the end to roll back.
|
||||
|
||||
This means it is safe to run multiple times without worrying about resetting the MAS database.
|
||||
It also means the time this dry-run takes is representative of the time it will take to perform the actual migration.
|
||||
|
||||
```sh
|
||||
mas-cli syn2mas migrate --config mas_config.yaml --synapse-config homeserver.yaml --dry-run
|
||||
```
|
||||
|
||||
## Doing the migration
|
||||
|
||||
Having done the preparation, you can now proceed with the actual migration. Note that this will require downtime for the homeserver and is not easily reversible.
|
||||
Having completed the preparation, you can now proceed with the actual migration. Note that this will require downtime for the homeserver and is not easily reversible.
|
||||
|
||||
### Backup your data
|
||||
### Backup your data and configuration
|
||||
|
||||
As with any migration, it is important to backup your data before proceeding.
|
||||
As with any migration, it is important to back up your data before proceeding.
|
||||
|
||||
### Shutdown the homeserver
|
||||
We also suggest making a backup copy of your homeserver's known good configuration before making any changes to enable MAS integration.
|
||||
|
||||
This is to ensure that no new sessions are created whilst the migration is in progress.
|
||||
### Shut down the homeserver
|
||||
|
||||
### Configure the homeserver
|
||||
This ensures that no new sessions are created while the migration is in progress.
|
||||
|
||||
### Configure the homeserver to enable MAS integration
|
||||
|
||||
Follow the instructions in the [homeserver configuration guide](homeserver.md) to configure the homeserver to use MAS.
|
||||
|
||||
### Do the import
|
||||
|
||||
Run `syn2mas` in non-dry-run mode.
|
||||
Once the homeserver has been stopped, MAS has been configured (but is not running!), and you have a successful migration check, run `syn2mas`'s `migrate` command.
|
||||
|
||||
```sh
|
||||
syn2mas --command migrate --synapseConfigFile homeserver.yaml --masConfigFile config.yaml --dryRun false
|
||||
mas-cli syn2mas migrate --config mas_config.yaml --synapse-config homeserver.yaml
|
||||
```
|
||||
|
||||
#### What to do if it goes wrong
|
||||
|
||||
If the migration fails with an error:
|
||||
|
||||
- You can try to fix the error and make another attempt by re-running the command; or
|
||||
- You can revert your homeserver configuration (so MAS integration is disabled once more) and abort the migration for now. In this case, you should not start MAS up.
|
||||
|
||||
In *some cases*, MAS may have written to its own database during a failed migration, causing it to complain in subsequent runs.
|
||||
In this case, you can safely delete and recreate the MAS database, then start over.
|
||||
|
||||
In *any case*, the migration tool itself **will not** write to the Synapse database, so as long as MAS hasn't been started, it is safe to roll back the migration without restoring the Synapse database.
|
||||
|
||||
Please report migration failures to the developers.
|
||||
|
||||
### Start up the homeserver
|
||||
|
||||
Start up the homeserver again with the new configuration.
|
||||
|
||||
### Update or serve the .well-known
|
||||
### Start up MAS
|
||||
|
||||
The `.well-known/matrix/client` needs to be served as described [here](./well-known.md).
|
||||
Now you can start MAS.
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
# .well-known configuration
|
||||
|
||||
A `.well-known/matrix/client` file is required to be served to allow clients to discover the authentication service.
|
||||
|
||||
If no `.well-known/matrix/client` file is served currently then this will need to be enabled.
|
||||
|
||||
If the homeserver is Synapse and serving this file already then the correct values will already be included when the homeserver is [configured to use MAS](./homeserver.md).
|
||||
|
||||
If the .well-known is hosted elsewhere then `org.matrix.msc2965.authentication` entries need to be included similar to the following:
|
||||
|
||||
```json
|
||||
{
|
||||
"m.homeserver": {
|
||||
"base_url": "https://matrix.example.com"
|
||||
},
|
||||
"org.matrix.msc2965.authentication": {
|
||||
"issuer": "https://example.com/",
|
||||
"account": "https://auth.example.com/account"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
For more context on what the correct values are, see [here](./).
|
||||
2
tools/syn2mas/.gitignore
vendored
2
tools/syn2mas/.gitignore
vendored
@@ -1,2 +0,0 @@
|
||||
node_modules
|
||||
dist
|
||||
@@ -1 +0,0 @@
|
||||
22
|
||||
@@ -1,48 +0,0 @@
|
||||
|
||||
# Build Node.js app
|
||||
FROM --platform=${BUILDPLATFORM} docker.io/library/node:22-bookworm AS builder
|
||||
|
||||
WORKDIR /syn2mas
|
||||
|
||||
COPY ./package.json ./package-lock.json ./tsconfig.json ./
|
||||
COPY ./src ./src
|
||||
RUN --network=default \
|
||||
npm ci
|
||||
|
||||
# Install the production dependencies for each architecture we support
|
||||
FROM --platform=${BUILDPLATFORM} docker.io/library/node:22-bookworm AS deps
|
||||
|
||||
WORKDIR /deps/arm64
|
||||
|
||||
COPY ./package.json ./package-lock.json ./
|
||||
# Remove the "prepare" script to avoid compiling typescript
|
||||
RUN sed -i '/"prepare"/d' package.json
|
||||
RUN --network=default \
|
||||
npm ci \
|
||||
--target_arch=amd64 \
|
||||
--target_platform=linux \
|
||||
--omit=dev
|
||||
|
||||
WORKDIR /deps/amd64
|
||||
|
||||
COPY ./package.json ./package-lock.json ./
|
||||
# Remove the "prepare" script to avoid compiling typescript
|
||||
RUN sed -i '/"prepare"/d' package.json
|
||||
RUN --network=default \
|
||||
npm ci \
|
||||
--target_arch=x64 \
|
||||
--target_platform=linux \
|
||||
--omit=dev
|
||||
|
||||
|
||||
# Runtime stage
|
||||
FROM gcr.io/distroless/nodejs18-debian12:debug-nonroot
|
||||
|
||||
WORKDIR /syn2mas
|
||||
COPY ./package.json ./package-lock.json ./
|
||||
COPY --from=builder /syn2mas/dist ./dist
|
||||
|
||||
ARG TARGETARCH
|
||||
COPY --from=deps /deps/${TARGETARCH}/node_modules ./node_modules
|
||||
|
||||
ENTRYPOINT ["/nodejs/bin/node", "--enable-source-maps", "/syn2mas/dist/index.js"]
|
||||
@@ -1,661 +0,0 @@
|
||||
GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
Version 3, 19 November 2007
|
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The GNU Affero General Public License is a free, copyleft license for
|
||||
software and other kinds of works, specifically designed to ensure
|
||||
cooperation with the community in the case of network server software.
|
||||
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
our General Public Licenses are intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains free
|
||||
software for all its users.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
|
||||
Developers that use our General Public Licenses protect your rights
|
||||
with two steps: (1) assert copyright on the software, and (2) offer
|
||||
you this License which gives you legal permission to copy, distribute
|
||||
and/or modify the software.
|
||||
|
||||
A secondary benefit of defending all users' freedom is that
|
||||
improvements made in alternate versions of the program, if they
|
||||
receive widespread use, become available for other developers to
|
||||
incorporate. Many developers of free software are heartened and
|
||||
encouraged by the resulting cooperation. However, in the case of
|
||||
software used on network servers, this result may fail to come about.
|
||||
The GNU General Public License permits making a modified version and
|
||||
letting the public access it on a server without ever releasing its
|
||||
source code to the public.
|
||||
|
||||
The GNU Affero General Public License is designed specifically to
|
||||
ensure that, in such cases, the modified source code becomes available
|
||||
to the community. It requires the operator of a network server to
|
||||
provide the source code of the modified version running there to the
|
||||
users of that server. Therefore, public use of a modified version, on
|
||||
a publicly accessible server, gives the public access to the source
|
||||
code of the modified version.
|
||||
|
||||
An older license, called the Affero General Public License and
|
||||
published by Affero, was designed to accomplish similar goals. This is
|
||||
a different license, not a version of the Affero GPL, but Affero has
|
||||
released a new version of the Affero GPL which permits relicensing under
|
||||
this license.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
TERMS AND CONDITIONS
|
||||
|
||||
0. Definitions.
|
||||
|
||||
"This License" refers to version 3 of the GNU Affero General Public License.
|
||||
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||
works, such as semiconductor masks.
|
||||
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of an
|
||||
exact copy. The resulting work is called a "modified version" of the
|
||||
earlier work or a work "based on" the earlier work.
|
||||
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user through
|
||||
a computer network, with no transfer of a copy, is not conveying.
|
||||
|
||||
An interactive user interface displays "Appropriate Legal Notices"
|
||||
to the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
|
||||
1. Source Code.
|
||||
|
||||
The "source code" for a work means the preferred form of the work
|
||||
for making modifications to it. "Object code" means any non-source
|
||||
form of a work.
|
||||
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
|
||||
The Corresponding Source need not include anything that users
|
||||
can regenerate automatically from other parts of the Corresponding
|
||||
Source.
|
||||
|
||||
The Corresponding Source for a work in source code form is that
|
||||
same work.
|
||||
|
||||
2. Basic Permissions.
|
||||
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
|
||||
You may make, run and propagate covered works that you do not
|
||||
convey, without conditions so long as your license otherwise remains
|
||||
in force. You may convey covered works to others for the sole purpose
|
||||
of having them make modifications exclusively for you, or provide you
|
||||
with facilities for running those works, provided that you comply with
|
||||
the terms of this License in conveying all material for which you do
|
||||
not control copyright. Those thus making or running the covered works
|
||||
for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of
|
||||
your copyrighted material outside their relationship with you.
|
||||
|
||||
Conveying under any other circumstances is permitted solely under
|
||||
the conditions stated below. Sublicensing is not allowed; section 10
|
||||
makes it unnecessary.
|
||||
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such circumvention
|
||||
is effected by exercising rights under this License with respect to
|
||||
the covered work, and you disclaim any intention to limit operation or
|
||||
modification of the work as a means of enforcing, against the work's
|
||||
users, your or third parties' legal rights to forbid circumvention of
|
||||
technological measures.
|
||||
|
||||
4. Conveying Verbatim Copies.
|
||||
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
|
||||
5. Conveying Modified Source Versions.
|
||||
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these conditions:
|
||||
|
||||
a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
|
||||
b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under section
|
||||
7. This requirement modifies the requirement in section 4 to
|
||||
"keep intact all notices".
|
||||
|
||||
c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
|
||||
d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
|
||||
6. Conveying Non-Source Forms.
|
||||
|
||||
You may convey a covered work in object code form under the terms
|
||||
of sections 4 and 5, provided that you also convey the
|
||||
machine-readable Corresponding Source under the terms of this License,
|
||||
in one of these ways:
|
||||
|
||||
a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
|
||||
b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
|
||||
c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
|
||||
d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
|
||||
e) Convey the object code using peer-to-peer transmission, provided
|
||||
you inform other peers where the object code and Corresponding
|
||||
Source of the work are being offered to the general public at no
|
||||
charge under subsection 6d.
|
||||
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal, family,
|
||||
or household purposes, or (2) anything designed or sold for incorporation
|
||||
into a dwelling. In determining whether a product is a consumer product,
|
||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||
product received by a particular user, "normally used" refers to a
|
||||
typical or common use of that class of product, regardless of the status
|
||||
of the particular user or of the way in which the particular user
|
||||
actually uses, or expects or is expected to use, the product. A product
|
||||
is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent
|
||||
the only significant mode of use of the product.
|
||||
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to install
|
||||
and execute modified versions of a covered work in that User Product from
|
||||
a modified version of its Corresponding Source. The information must
|
||||
suffice to ensure that the continued functioning of the modified object
|
||||
code is in no case prevented or interfered with solely because
|
||||
modification has been made.
|
||||
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or updates
|
||||
for a work that has been modified or installed by the recipient, or for
|
||||
the User Product in which it has been modified or installed. Access to a
|
||||
network may be denied when the modification itself materially and
|
||||
adversely affects the operation of the network or violates the rules and
|
||||
protocols for communication across the network.
|
||||
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
|
||||
7. Additional Terms.
|
||||
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders of
|
||||
that material) supplement the terms of this License with terms:
|
||||
|
||||
a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
|
||||
b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
|
||||
c) Prohibiting misrepresentation of the origin of that material, or
|
||||
requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
|
||||
d) Limiting the use for publicity purposes of names of licensors or
|
||||
authors of the material; or
|
||||
|
||||
e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
|
||||
f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions of
|
||||
it) with contractual assumptions of liability to the recipient, for
|
||||
any liability that these contractual assumptions directly impose on
|
||||
those licensors and authors.
|
||||
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions;
|
||||
the above requirements apply either way.
|
||||
|
||||
8. Termination.
|
||||
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly and
|
||||
finally terminates your license, and (b) permanently, if the copyright
|
||||
holder fails to notify you of the violation by some reasonable means
|
||||
prior to 60 days after the cessation.
|
||||
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
|
||||
You are not required to accept this License in order to receive or
|
||||
run a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
|
||||
11. Patents.
|
||||
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
|
||||
A contributor's "essential patent claims" are all patent claims
|
||||
owned or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
|
||||
A patent license is "discriminatory" if it does not include within
|
||||
the scope of its coverage, prohibits the exercise of, or is
|
||||
conditioned on the non-exercise of one or more of the rights that are
|
||||
specifically granted under this License. You may not convey a covered
|
||||
work if you are a party to an arrangement with a third party that is
|
||||
in the business of distributing software, under which you make payment
|
||||
to the third party based on the extent of your activity of conveying
|
||||
the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory
|
||||
patent license (a) in connection with copies of the covered work
|
||||
conveyed by you (or copies made from those copies), or (b) primarily
|
||||
for and in connection with specific products or compilations that
|
||||
contain the covered work, unless you entered into that arrangement,
|
||||
or that patent license was granted, prior to 28 March 2007.
|
||||
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
|
||||
12. No Surrender of Others' Freedom.
|
||||
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you may
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey
|
||||
the Program, the only way you could satisfy both those terms and this
|
||||
License would be to refrain entirely from conveying the Program.
|
||||
|
||||
13. Remote Network Interaction; Use with the GNU General Public License.
|
||||
|
||||
Notwithstanding any other provision of this License, if you modify the
|
||||
Program, your modified version must prominently offer all users
|
||||
interacting with it remotely through a computer network (if your version
|
||||
supports such interaction) an opportunity to receive the Corresponding
|
||||
Source of your version by providing access to the Corresponding Source
|
||||
from a network server at no charge, through some standard or customary
|
||||
means of facilitating copying of software. This Corresponding Source
|
||||
shall include the Corresponding Source for any work covered by version 3
|
||||
of the GNU General Public License that is incorporated pursuant to the
|
||||
following paragraph.
|
||||
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the work with which it is combined will remain governed by version
|
||||
3 of the GNU General Public License.
|
||||
|
||||
14. Revised Versions of this License.
|
||||
|
||||
The Free Software Foundation may publish revised and/or new versions of
|
||||
the GNU Affero General Public License from time to time. Such new versions
|
||||
will be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the
|
||||
Program specifies that a certain numbered version of the GNU Affero General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU Affero General Public License, you may choose any version ever published
|
||||
by the Free Software Foundation.
|
||||
|
||||
If the Program specifies that a proxy can decide which future
|
||||
versions of the GNU Affero General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
|
||||
15. Disclaimer of Warranty.
|
||||
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. Limitation of Liability.
|
||||
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGES.
|
||||
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
state the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU Affero General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU Affero General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Affero General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If your software can interact with users remotely through a computer
|
||||
network, you should also make sure that it provides a way for users to
|
||||
get its source. For example, if your program is a web application, its
|
||||
interface could display a "Source" link that leads users to an archive
|
||||
of the code. There are many ways you could offer source, and different
|
||||
solutions will be better for different programs; see section 13 for the
|
||||
specific requirements.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or school,
|
||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||
For more information on this, and how to apply and follow the GNU AGPL, see
|
||||
<https://www.gnu.org/licenses/>.
|
||||
@@ -1,16 +0,0 @@
|
||||
# syn2mas - Synapse to Matrix Authentication Service
|
||||
|
||||
Tool to help with the migration of a Matrix Synapse installation to the Matrix Authentication Service.
|
||||
|
||||
The tool has two modes of operation:
|
||||
|
||||
- Advisor mode: Analyses the Synapse configuration and reports on any issues that would prevent a successful migration.
|
||||
- Migration mode: Performs the migration of the Synapse database into the Matrix Authentication Service database.
|
||||
|
||||
## Usage
|
||||
|
||||
Pre-migration advisor:
|
||||
|
||||
```sh
|
||||
npx @vector-im/syn2mas --command=advisor --synapseConfigFile homeserver.yaml
|
||||
```
|
||||
3107
tools/syn2mas/package-lock.json
generated
3107
tools/syn2mas/package-lock.json
generated
File diff suppressed because it is too large
Load Diff
@@ -1,55 +0,0 @@
|
||||
{
|
||||
"name": "@vector-im/syn2mas",
|
||||
"version": "0.15.0",
|
||||
"description": "A tool to migrate Synapse users and sessions to the Matrix Authentication Service",
|
||||
"license": "AGPL-3.0-only",
|
||||
"author": "Matrix.org",
|
||||
"type": "module",
|
||||
"repository": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/element-hq/matrix-authentication-service"
|
||||
},
|
||||
"bin": {
|
||||
"syn2mas": "dist/index.js"
|
||||
},
|
||||
"files": [
|
||||
"src",
|
||||
"dist",
|
||||
"package.json",
|
||||
"LICENSE",
|
||||
"README.md"
|
||||
],
|
||||
"publishConfig": {
|
||||
"access": "public"
|
||||
},
|
||||
"scripts": {
|
||||
"prepare": "npm run build",
|
||||
"build": "tsc",
|
||||
"dev": "tsx src/index.ts",
|
||||
"lint": "npm run lint:types && npm run lint:style",
|
||||
"lint:style": "biome check",
|
||||
"lint:types": "tsc --noEmit",
|
||||
"start": "node dist/index.js"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@biomejs/biome": "^1.9.4",
|
||||
"@tsconfig/node22": "^22.0.0",
|
||||
"@tsconfig/strictest": "^2.0.2",
|
||||
"@types/command-line-args": "^5.2.2",
|
||||
"@types/node": "^22.0.0",
|
||||
"tsx": "^4.16.2",
|
||||
"typescript": "^5.2.2"
|
||||
},
|
||||
"dependencies": {
|
||||
"command-line-args": "^6.0.0",
|
||||
"id128": "^1.6.6",
|
||||
"knex": "^3.0.1",
|
||||
"log4js": "^6.9.1",
|
||||
"pg": "^8.11.3",
|
||||
"pg-query-stream": "^4.6.0",
|
||||
"sqlite3": "^5.1.6",
|
||||
"ts-command-line-args": "^2.5.1",
|
||||
"yaml": "^2.3.3",
|
||||
"zod": "^3.22.4"
|
||||
}
|
||||
}
|
||||
@@ -1,251 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import { readFile } from "node:fs/promises";
|
||||
|
||||
import type { Knex } from "knex";
|
||||
import log4js from "log4js";
|
||||
import { parse } from "ts-command-line-args";
|
||||
import yaml from "yaml";
|
||||
|
||||
import { connectToSynapseDatabase } from "./db.mjs";
|
||||
import {
|
||||
type SynapseOIDCProvider,
|
||||
synapseConfig as synapseConfigSchema,
|
||||
} from "./schemas/synapse.mjs";
|
||||
import type { SAccessToken } from "./types/SAccessToken.d.ts";
|
||||
import type { SRefreshToken } from "./types/SRefreshToken.d.ts";
|
||||
import type { SUser } from "./types/SUser.d.ts";
|
||||
import type { SUserThreePid } from "./types/SUserThreePid.d.ts";
|
||||
|
||||
const log = log4js.getLogger("migrate");
|
||||
|
||||
interface Options {
|
||||
command: string;
|
||||
synapseConfigFile: string;
|
||||
help?: boolean;
|
||||
}
|
||||
|
||||
export async function advisor(): Promise<void> {
|
||||
const args = parse<Options>(
|
||||
{
|
||||
command: {
|
||||
type: String,
|
||||
description: "Command to run",
|
||||
defaultOption: true,
|
||||
typeLabel: "migrate",
|
||||
},
|
||||
synapseConfigFile: {
|
||||
type: String,
|
||||
description: "Path to synapse homeserver.yaml config file",
|
||||
},
|
||||
help: {
|
||||
type: Boolean,
|
||||
optional: true,
|
||||
alias: "h",
|
||||
description: "Prints this usage guide",
|
||||
},
|
||||
},
|
||||
{
|
||||
helpArg: "help",
|
||||
},
|
||||
);
|
||||
|
||||
const warnings: string[] = [];
|
||||
function warn(message: string): void {
|
||||
log.warn(message);
|
||||
warnings.push(message);
|
||||
}
|
||||
|
||||
const errors: string[] = [];
|
||||
function error(message: string): void {
|
||||
log.error(message);
|
||||
errors.push(message);
|
||||
}
|
||||
|
||||
// load synapse config
|
||||
const synapseConfig = synapseConfigSchema.parse(
|
||||
yaml.parse(await readFile(args.synapseConfigFile, "utf8")),
|
||||
);
|
||||
|
||||
// connect to synapse databases
|
||||
const synapse = await connectToSynapseDatabase(synapseConfig);
|
||||
|
||||
async function count(query: Knex.QueryBuilder): Promise<number> {
|
||||
const res = await query.first();
|
||||
if (!res) {
|
||||
return 0;
|
||||
}
|
||||
return res["count(*)"] as number;
|
||||
}
|
||||
|
||||
const guestUsers = await count(
|
||||
synapse.count("*").from<SUser>("users").where({ is_guest: 1 }),
|
||||
);
|
||||
if (guestUsers > 0) {
|
||||
error(
|
||||
`Synapse database contains ${guestUsers} guest users which aren't supported by MAS: https://github.com/element-hq/matrix-authentication-service/issues/1445`,
|
||||
);
|
||||
}
|
||||
if (synapseConfig.allow_guest_access) {
|
||||
if (guestUsers > 0) {
|
||||
error(
|
||||
"Synapse config allows guest access which isn't supported by MAS: https://github.com/element-hq/matrix-authentication-service/issues/1445",
|
||||
);
|
||||
} else {
|
||||
error(
|
||||
"Synapse config allows guest access which isn't supported by MAS, but no guest users were found in the database so the option could be disabled: https://github.com/element-hq/matrix-authentication-service/issues/1445",
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
if (synapseConfig.enable_registration) {
|
||||
warn(
|
||||
"Synapse config has registration enabled which will need to be disabled after migration",
|
||||
);
|
||||
}
|
||||
if (synapseConfig.enable_registration_captcha) {
|
||||
warn(
|
||||
"Synapse config has registration CAPTCHA enabled which will need to configured in MAS",
|
||||
);
|
||||
}
|
||||
if (synapseConfig.user_consent) {
|
||||
warn(
|
||||
"Synapse config has user_consent configured which will need to be disabled after migration",
|
||||
);
|
||||
}
|
||||
|
||||
const usersWithoutEmailAddress = await count(
|
||||
synapse
|
||||
.count("*")
|
||||
.from<SUser>("users")
|
||||
.leftOuterJoin<SUserThreePid>(
|
||||
"user_threepids",
|
||||
"users.name",
|
||||
"user_threepids.user_id",
|
||||
)
|
||||
.whereNull("user_threepids.user_id"),
|
||||
);
|
||||
if (usersWithoutEmailAddress > 0) {
|
||||
warn(
|
||||
`Synapse database contains ${usersWithoutEmailAddress} users without a verified email address who will need to verify their email address before they can login after migration: https://github.com/element-hq/matrix-authentication-service/issues/1505`,
|
||||
);
|
||||
}
|
||||
|
||||
const accessTokensWithoutDeviceId = await count(
|
||||
synapse
|
||||
.count("*")
|
||||
.from<SAccessToken>("access_tokens")
|
||||
.where({ device_id: "" })
|
||||
.orWhereNull("device_id"),
|
||||
);
|
||||
if (accessTokensWithoutDeviceId > 0) {
|
||||
error(
|
||||
`Synapse database contains ${accessTokensWithoutDeviceId} access tokens without an associated device_id which will be skipped during migration`,
|
||||
);
|
||||
}
|
||||
|
||||
const nonEmailThreePids = await count(
|
||||
synapse
|
||||
.count("*")
|
||||
.from<SUserThreePid>("user_threepids")
|
||||
.whereNot({ medium: "email" }),
|
||||
);
|
||||
if (nonEmailThreePids > 0) {
|
||||
error(
|
||||
`Synapse database contains ${nonEmailThreePids} non-email 3pids which will be ignored during migration`,
|
||||
);
|
||||
}
|
||||
|
||||
const oidcProviders: SynapseOIDCProvider[] = [
|
||||
...(synapseConfig.oidc_providers ?? []),
|
||||
...(synapseConfig.oidc_config ? [synapseConfig.oidc_config] : []),
|
||||
];
|
||||
for (const provider of oidcProviders) {
|
||||
warn(
|
||||
`Synapse config contains OIDC auth configuration which will need mapping to be manually mapped to an upstream OpenID Provider during migration: ${provider.issuer}`,
|
||||
);
|
||||
}
|
||||
|
||||
if (synapseConfig.cas_config?.enabled) {
|
||||
warn(
|
||||
"Synapse config contains CAS auth configuration which will need mapping to be manually mapped to an upstream OpenID Provider during migration",
|
||||
);
|
||||
}
|
||||
if (synapseConfig.saml2_config?.sp_config) {
|
||||
warn(
|
||||
"Synapse config contains SAML2 auth configuration which will need mapping to be manually mapped to an upstream OpenID Provider during migration",
|
||||
);
|
||||
}
|
||||
if (synapseConfig.jwt_config?.enabled) {
|
||||
warn(
|
||||
"Synapse config contains JWT auth configuration which will need mapping to be manually mapped to an upstream OpenID Provider during migration",
|
||||
);
|
||||
}
|
||||
if (
|
||||
synapseConfig.password_config?.enabled !== false &&
|
||||
synapseConfig.password_config?.localdb_enabled === false
|
||||
) {
|
||||
warn(
|
||||
"Synapse has a non-standard password auth enabled which won't work after migration and will need to be manually mapped to an upstream OpenID Provider during migration",
|
||||
);
|
||||
}
|
||||
|
||||
const externalIdAuthProviders = (await synapse
|
||||
.select("auth_provider")
|
||||
.count("* as Count")
|
||||
.from("user_external_ids")
|
||||
.groupBy("auth_provider")) as { auth_provider: string; Count: number }[];
|
||||
for (const row of externalIdAuthProviders) {
|
||||
warn(
|
||||
`An upstream OpenID Provider will need to be configured for the ${row.Count} users with auth provider ${row.auth_provider}`,
|
||||
);
|
||||
}
|
||||
|
||||
const usersWithPassword = await count(
|
||||
synapse.count("*").from<SUser>("users").whereNotNull("password_hash"),
|
||||
);
|
||||
if (usersWithPassword > 0) {
|
||||
log.info(
|
||||
`Synapse database contains ${usersWithPassword} users with a password which will be migrated.`,
|
||||
);
|
||||
}
|
||||
|
||||
const accessTokensToImport = await count(
|
||||
synapse
|
||||
.count("*")
|
||||
.from<SAccessToken>("access_tokens")
|
||||
.whereNotNull("device_id"),
|
||||
);
|
||||
if (accessTokensToImport > 0) {
|
||||
log.info(
|
||||
`Synapse database contains ${accessTokensToImport} access tokens which will be migrated`,
|
||||
);
|
||||
}
|
||||
|
||||
const synapseRefreshToken = await count(
|
||||
synapse.select("*").from<SRefreshToken>("refresh_tokens"),
|
||||
);
|
||||
if (synapseRefreshToken > 0) {
|
||||
log.info(
|
||||
`Synapse database contains ${synapseRefreshToken} refresh tokens which will be migrated`,
|
||||
);
|
||||
}
|
||||
|
||||
if (synapseConfig.enable_3pid_changes === true) {
|
||||
warn(
|
||||
"Synapse config has enable_3pid_changes enabled which must to be disabled or removed after migration",
|
||||
);
|
||||
}
|
||||
|
||||
if (synapseConfig.login_via_existing_session?.enabled === true) {
|
||||
warn(
|
||||
"Synapse config has login_via_existing_session enabled which must to be disabled or removed after migration",
|
||||
);
|
||||
}
|
||||
|
||||
process.exit(errors.length > 0 ? 1 : 0);
|
||||
}
|
||||
@@ -1,108 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import { readFile } from "node:fs/promises";
|
||||
import type { SecureContextOptions } from "node:tls";
|
||||
|
||||
import knex, { type Knex } from "knex";
|
||||
|
||||
import type {
|
||||
MASConfig,
|
||||
DatabaseConfig as MASDatabaseConfig,
|
||||
URIDatabaseConfig as MASURIDatabaseConfig,
|
||||
} from "./schemas/mas.mjs";
|
||||
import type { SynapseConfig } from "./schemas/synapse.mjs";
|
||||
|
||||
export async function connectToSynapseDatabase({
|
||||
database,
|
||||
}: SynapseConfig): Promise<Knex> {
|
||||
if (!database) {
|
||||
throw new Error("Synapse database not configured");
|
||||
}
|
||||
|
||||
if (database.name === "sqlite3") {
|
||||
return knex({
|
||||
client: "sqlite3",
|
||||
connection: { filename: database.args.database },
|
||||
useNullAsDefault: true,
|
||||
});
|
||||
}
|
||||
|
||||
const connection: Knex.PgConnectionConfig = {};
|
||||
if (database.args.database) connection.database = database.args.database;
|
||||
if (database.args.dbname) connection.database = database.args.dbname;
|
||||
if (database.args.user) connection.user = database.args.user;
|
||||
if (database.args.password) connection.password = database.args.password;
|
||||
if (database.args.host) connection.host = database.args.host;
|
||||
if (typeof database.args.port === "number")
|
||||
connection.port = database.args.port;
|
||||
if (typeof database.args.port === "string")
|
||||
connection.port = Number.parseInt(database.args.port);
|
||||
|
||||
const ssl: SecureContextOptions = {};
|
||||
if (database.args.sslcert) ssl.cert = await readFile(database.args.sslcert);
|
||||
if (database.args.sslrootcert)
|
||||
ssl.ca = await readFile(database.args.sslrootcert);
|
||||
if (database.args.sslkey) ssl.key = await readFile(database.args.sslkey);
|
||||
if (database.args.sslpassword) ssl.passphrase = database.args.sslpassword;
|
||||
|
||||
if (Object.keys(ssl).length > 0) {
|
||||
connection.ssl = ssl;
|
||||
}
|
||||
|
||||
return knex({
|
||||
client: "pg",
|
||||
connection,
|
||||
});
|
||||
}
|
||||
|
||||
const isUriConfig = (
|
||||
database: MASDatabaseConfig,
|
||||
): database is MASURIDatabaseConfig =>
|
||||
"uri" in database && typeof database.uri === "string";
|
||||
|
||||
export async function connectToMASDatabase({
|
||||
database,
|
||||
}: MASConfig): Promise<Knex> {
|
||||
const connection: Knex.PgConnectionConfig = {};
|
||||
const ssl: SecureContextOptions = {};
|
||||
if (isUriConfig(database)) {
|
||||
connection.connectionString = database.uri;
|
||||
} else {
|
||||
if (database.database) connection.database = database.database;
|
||||
if (database.username) connection.user = database.username;
|
||||
if (database.password) connection.password = database.password;
|
||||
if (database.host) connection.host = database.host;
|
||||
if (database.port) connection.port = database.port;
|
||||
}
|
||||
|
||||
if (database.ssl_ca) {
|
||||
ssl.ca = database.ssl_ca;
|
||||
} else if (database.ssl_ca_file) {
|
||||
ssl.ca = await readFile(database.ssl_ca_file);
|
||||
}
|
||||
|
||||
if (database.ssl_certificate) {
|
||||
ssl.cert = database.ssl_certificate;
|
||||
} else if (database.ssl_certificate_file) {
|
||||
ssl.cert = await readFile(database.ssl_certificate_file);
|
||||
}
|
||||
|
||||
if (database.ssl_key) {
|
||||
ssl.key = database.ssl_key;
|
||||
} else if (database.ssl_key_file) {
|
||||
ssl.key = await readFile(database.ssl_key_file);
|
||||
}
|
||||
|
||||
if (Object.keys(ssl).length > 0) {
|
||||
connection.ssl = ssl;
|
||||
}
|
||||
|
||||
return knex({
|
||||
client: "pg",
|
||||
connection,
|
||||
});
|
||||
}
|
||||
@@ -1,65 +0,0 @@
|
||||
#!/usr/bin/env node
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import log4js from "log4js";
|
||||
import { type ArgumentConfig, parse } from "ts-command-line-args";
|
||||
|
||||
import { advisor } from "./advisor.mjs";
|
||||
import { migrate } from "./migrate.mjs";
|
||||
|
||||
log4js.configure({
|
||||
appenders: {
|
||||
console: { type: "console" },
|
||||
},
|
||||
categories: {
|
||||
default: { appenders: ["console"], level: "debug" },
|
||||
},
|
||||
});
|
||||
|
||||
const log = log4js.getLogger();
|
||||
|
||||
interface MainOptions {
|
||||
command: string;
|
||||
help?: boolean;
|
||||
}
|
||||
|
||||
const mainArgOptions: ArgumentConfig<MainOptions> = {
|
||||
command: {
|
||||
type: String,
|
||||
description: "Command to run",
|
||||
defaultOption: true,
|
||||
typeLabel: "<advisor|migrate>",
|
||||
},
|
||||
help: {
|
||||
type: Boolean,
|
||||
optional: true,
|
||||
alias: "h",
|
||||
description: "Prints this usage guide",
|
||||
},
|
||||
};
|
||||
|
||||
export const mainArgs = parse<MainOptions>(mainArgOptions, {
|
||||
stopAtFirstUnknown: true,
|
||||
});
|
||||
|
||||
try {
|
||||
if (mainArgs.command === "migrate") {
|
||||
await migrate();
|
||||
process.exit(0);
|
||||
}
|
||||
|
||||
if (mainArgs.command === "advisor") {
|
||||
await advisor();
|
||||
process.exit(0);
|
||||
}
|
||||
|
||||
parse<MainOptions>(mainArgOptions, { helpArg: "help" });
|
||||
process.exit(1);
|
||||
} catch (e) {
|
||||
log.error(e);
|
||||
process.exit(1);
|
||||
}
|
||||
@@ -1,461 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import { readFile } from "node:fs/promises";
|
||||
|
||||
import id128 from "id128";
|
||||
import log4js from "log4js";
|
||||
import { parse } from "ts-command-line-args";
|
||||
import yaml from "yaml";
|
||||
|
||||
import { connectToMASDatabase, connectToSynapseDatabase } from "./db.mjs";
|
||||
import { masConfig as masConfigSchema } from "./schemas/mas.mjs";
|
||||
import { synapseConfig as synapseConfigSchema } from "./schemas/synapse.mjs";
|
||||
import type { MCompatAccessToken } from "./types/MCompatAccessToken.d.ts";
|
||||
import type { MCompatRefreshToken } from "./types/MCompatRefreshToken.d.ts";
|
||||
import type { MCompatSession } from "./types/MCompatSession.d.ts";
|
||||
import type { MUpstreamOauthLink } from "./types/MUpstreamOauthLink.d.ts";
|
||||
import type { MUpstreamOauthProvider } from "./types/MUpstreamOauthProvider.d.ts";
|
||||
import type { MUser } from "./types/MUser.js";
|
||||
import type { MUserEmail } from "./types/MUserEmail.d.ts";
|
||||
import type { MUserPassword } from "./types/MUserPassword.d.ts";
|
||||
import type { SAccessToken } from "./types/SAccessToken.d.ts";
|
||||
import type { SRefreshToken } from "./types/SRefreshToken.d.ts";
|
||||
import type { SUser } from "./types/SUser.d.ts";
|
||||
import type { SUserExternalId } from "./types/SUserExternalId.d.ts";
|
||||
import type { SUserThreePid } from "./types/SUserThreePid.d.ts";
|
||||
import type { UUID } from "./types/index.d.ts";
|
||||
|
||||
const log = log4js.getLogger("migrate");
|
||||
|
||||
interface MigrationOptions {
|
||||
command: string;
|
||||
synapseConfigFile: string;
|
||||
masConfigFile: string;
|
||||
upstreamProviderMapping: string[];
|
||||
dryRun?: boolean;
|
||||
help?: boolean;
|
||||
}
|
||||
|
||||
// Parses a string that is either a UUID or a ULID
|
||||
// Returns [uuid, ulid] in canonical format
|
||||
const parseUuidOrUlid = (input: string): [string, string] => {
|
||||
let bytes: Uint8Array;
|
||||
if (id128.Ulid.isCanonical(input)) {
|
||||
bytes = id128.Ulid.fromCanonicalTrusted(input).bytes;
|
||||
} else if (id128.Uuid.isCanonical(input)) {
|
||||
bytes = id128.Uuid.fromCanonicalTrusted(input).bytes;
|
||||
} else {
|
||||
bytes = id128.Uuid.fromRaw(input).bytes;
|
||||
}
|
||||
|
||||
return [
|
||||
id128.Uuid.construct(bytes).toCanonical(),
|
||||
id128.Ulid.construct(bytes).toCanonical(),
|
||||
];
|
||||
};
|
||||
|
||||
export async function migrate(): Promise<void> {
|
||||
const args = parse<MigrationOptions>(
|
||||
{
|
||||
command: {
|
||||
type: String,
|
||||
description: "Command to run",
|
||||
defaultOption: true,
|
||||
typeLabel: "migrate",
|
||||
},
|
||||
synapseConfigFile: {
|
||||
type: String,
|
||||
description: "Path to synapse homeserver.yaml config file",
|
||||
},
|
||||
masConfigFile: { type: String, description: "Path to MAS config.yaml" },
|
||||
upstreamProviderMapping: {
|
||||
type: String,
|
||||
defaultValue: [],
|
||||
multiple: true,
|
||||
description:
|
||||
"Mapping of upstream provider IDs to MAS provider IDs. Format: <upstream_provider_id>:<mas_provider_id>",
|
||||
},
|
||||
dryRun: {
|
||||
type: Boolean,
|
||||
optional: true,
|
||||
defaultValue: false,
|
||||
description: "Dry run only, do not write to database",
|
||||
},
|
||||
help: {
|
||||
type: Boolean,
|
||||
optional: true,
|
||||
alias: "h",
|
||||
description: "Prints this usage guide",
|
||||
},
|
||||
},
|
||||
{
|
||||
helpArg: "help",
|
||||
},
|
||||
);
|
||||
|
||||
const warnings: string[] = [];
|
||||
function warn(message: string): void {
|
||||
warnings.push(message);
|
||||
}
|
||||
|
||||
let fatals = 0;
|
||||
function fatal(message: string): void {
|
||||
log.fatal(message);
|
||||
for (const w of warnings) log.warn(w);
|
||||
if (!args.dryRun) {
|
||||
process.exit(1);
|
||||
}
|
||||
fatals += 1;
|
||||
}
|
||||
|
||||
function makeUuid<T>(time: Date): UUID<T> {
|
||||
return id128.Uuid.construct(
|
||||
id128.Ulid.generate({ time }).bytes,
|
||||
).toCanonical();
|
||||
}
|
||||
|
||||
// load synapse config
|
||||
const synapseConfig = synapseConfigSchema.parse(
|
||||
yaml.parse(await readFile(args.synapseConfigFile, "utf8")),
|
||||
);
|
||||
|
||||
// connect to synapse database
|
||||
const synapse = await connectToSynapseDatabase(synapseConfig);
|
||||
|
||||
// load MAS config
|
||||
const masConfig = masConfigSchema.parse(
|
||||
yaml.parse(await readFile(args.masConfigFile, "utf8")),
|
||||
);
|
||||
|
||||
// connect to MAS database
|
||||
const mas = await connectToMASDatabase(masConfig);
|
||||
|
||||
const upstreamProviders = new Map<string, MUpstreamOauthProvider>();
|
||||
|
||||
for (const mapping of args.upstreamProviderMapping) {
|
||||
const [providerId, masProviderId] = mapping.split(":");
|
||||
if (!providerId || !masProviderId) {
|
||||
throw new Error(
|
||||
`Upstream provider mapping is not in correct format. It should be <upstream_provider_id>:<mas_provider_id>: ${mapping}`,
|
||||
);
|
||||
}
|
||||
|
||||
if (
|
||||
!id128.Uuid.isRaw(masProviderId) &&
|
||||
!id128.Uuid.isCanonical(masProviderId) &&
|
||||
!id128.Ulid.isCanonical(masProviderId)
|
||||
) {
|
||||
throw new Error(
|
||||
`Upstream provider mapping is not in correct format. It should be a UUID or a ULID: ${masProviderId}`,
|
||||
);
|
||||
}
|
||||
|
||||
const [masProviderUuid, masProviderUlid] = parseUuidOrUlid(masProviderId);
|
||||
|
||||
log.info(
|
||||
`Loading existing upstream provider ${masProviderUlid} from MAS database as ${providerId}`,
|
||||
);
|
||||
const existingProvider = await mas("upstream_oauth_providers")
|
||||
.select("*")
|
||||
.where({ upstream_oauth_provider_id: masProviderUuid })
|
||||
.first();
|
||||
if (!existingProvider) {
|
||||
throw new Error(
|
||||
`Could not find upstream provider ${masProviderUlid} in MAS database`,
|
||||
);
|
||||
}
|
||||
upstreamProviders.set(providerId, existingProvider);
|
||||
}
|
||||
|
||||
function stringifyAndRedact(input: unknown): string {
|
||||
const x = JSON.stringify(input);
|
||||
|
||||
return x.replace(
|
||||
/("(password_hash|hashed_password|access_token|token)":")[^"]*"/,
|
||||
'$1redacted"',
|
||||
);
|
||||
}
|
||||
|
||||
type Execution = () => Promise<void>;
|
||||
|
||||
const existingMasUsers = await mas
|
||||
.count({ count: "*" })
|
||||
.from("users")
|
||||
.first();
|
||||
|
||||
if (Number.parseInt(`${existingMasUsers?.count ?? 0}`) > 0) {
|
||||
fatal(
|
||||
`Found ${existingMasUsers?.count} existing users in MAS. Refusing to continue. Please clean MAS and try again.`,
|
||||
);
|
||||
}
|
||||
|
||||
async function migrateUser(user: SUser): Promise<void> {
|
||||
const localpart = user.name.split(":")[0].substring(1);
|
||||
log.info(`Processing user ${user.name} as ${localpart}`);
|
||||
|
||||
let warningsForUser = 0;
|
||||
const executions: Execution[] = [];
|
||||
|
||||
if (user.is_guest === 1) {
|
||||
fatal(`Migration of guest users is not supported: ${user.name}`);
|
||||
}
|
||||
|
||||
// users => users
|
||||
const userCreatedAt = new Date(
|
||||
Number.parseInt(`${user.creation_ts}`) * 1000,
|
||||
);
|
||||
const masUser: MUser = {
|
||||
user_id: makeUuid(userCreatedAt),
|
||||
username: localpart,
|
||||
created_at: userCreatedAt,
|
||||
locked_at: user.deactivated === 1 ? userCreatedAt : null,
|
||||
can_request_admin: user.admin === 1,
|
||||
};
|
||||
executions.push(() => mas.insert(masUser).into("users"));
|
||||
log.debug(`${stringifyAndRedact(user)} => ${stringifyAndRedact(masUser)}`);
|
||||
// users.password_hash => user_passwords
|
||||
if (user.password_hash) {
|
||||
const masUserPassword: MUserPassword = {
|
||||
user_password_id: makeUuid(userCreatedAt),
|
||||
user_id: masUser.user_id,
|
||||
hashed_password: user.password_hash,
|
||||
created_at: masUser.created_at, // TODO: should we use now() instead of created_at?
|
||||
version: 1,
|
||||
};
|
||||
|
||||
log.debug(
|
||||
`Password ${user.password_hash.slice(-4)} => ${stringifyAndRedact(
|
||||
masUserPassword,
|
||||
)}`,
|
||||
);
|
||||
executions.push(() => mas.insert(masUserPassword).into("user_passwords"));
|
||||
}
|
||||
|
||||
// user_threepids => user_emails
|
||||
const synapseThreePids = await synapse
|
||||
.select("*")
|
||||
.from<SUserThreePid>("user_threepids")
|
||||
.where({ user_id: user.name });
|
||||
for (const threePid of synapseThreePids) {
|
||||
if (threePid.medium !== "email") {
|
||||
warningsForUser += 1;
|
||||
warn(
|
||||
`Skipping non-email 3pid ${threePid.medium} for user ${user.name}`,
|
||||
);
|
||||
continue;
|
||||
}
|
||||
const threePidCreatedAt = new Date(
|
||||
Number.parseInt(`${threePid.added_at}`),
|
||||
);
|
||||
const masUserEmail: MUserEmail = {
|
||||
user_email_id: makeUuid(threePidCreatedAt),
|
||||
user_id: masUser.user_id,
|
||||
email: threePid.address.toLowerCase(),
|
||||
created_at: threePidCreatedAt,
|
||||
};
|
||||
|
||||
if (threePid.validated_at) {
|
||||
masUserEmail.confirmed_at = new Date(
|
||||
Number.parseInt(`${threePid.validated_at}`),
|
||||
);
|
||||
}
|
||||
|
||||
log.debug(
|
||||
`${stringifyAndRedact(threePid)} => ${stringifyAndRedact(
|
||||
masUserEmail,
|
||||
)}`,
|
||||
);
|
||||
executions.push(() => mas.insert(masUserEmail).into("user_emails"));
|
||||
}
|
||||
|
||||
// user_external_ids => upstream_oauth_links
|
||||
const synapseExternalIds = await synapse
|
||||
.select("*")
|
||||
.from<SUserExternalId>("user_external_ids")
|
||||
.where({ user_id: user.name });
|
||||
for (const externalId of synapseExternalIds) {
|
||||
try {
|
||||
const provider = upstreamProviders.get(externalId.auth_provider);
|
||||
if (!provider) {
|
||||
throw new Error(
|
||||
`Unknown upstream provider ${externalId.auth_provider}`,
|
||||
);
|
||||
}
|
||||
const masUpstreamOauthLink: MUpstreamOauthLink = {
|
||||
upstream_oauth_link_id: makeUuid(userCreatedAt),
|
||||
user_id: masUser.user_id,
|
||||
upstream_oauth_provider_id: provider.upstream_oauth_provider_id,
|
||||
subject: externalId.external_id,
|
||||
created_at: masUser.created_at,
|
||||
};
|
||||
|
||||
log.debug(
|
||||
`${stringifyAndRedact(synapseExternalIds)} => ${stringifyAndRedact(
|
||||
masUpstreamOauthLink,
|
||||
)}`,
|
||||
);
|
||||
|
||||
executions.push(() =>
|
||||
mas.insert(masUpstreamOauthLink).into("upstream_oauth_links"),
|
||||
);
|
||||
} catch (e) {
|
||||
fatal(
|
||||
`Failed to import external id ${externalId.external_id} with ${externalId.auth_provider} for user ${user.name}: ${e}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// We only import access tokens for active users
|
||||
if (user.deactivated === 1) {
|
||||
log.info(
|
||||
`Skipping access tokens import for deactivated user ${user.name}`,
|
||||
);
|
||||
} else {
|
||||
// access_tokens,refresh_tokens => compat_sessions,compat_access_tokens
|
||||
const synapseAccessTokens = await synapse
|
||||
.select("*")
|
||||
.from<SAccessToken>("access_tokens")
|
||||
.where({ user_id: user.name })
|
||||
// Skip tokens without devices.
|
||||
// These can be for example short-lived tokens created by puppeting a user over the Synapse admin API.
|
||||
.whereNotNull("device_id");
|
||||
for (const accessToken of synapseAccessTokens) {
|
||||
const tokenCreatedAt = accessToken.last_validated
|
||||
? new Date(Number.parseInt(`${accessToken.last_validated}`))
|
||||
: masUser.created_at;
|
||||
const masCompatSession: MCompatSession = {
|
||||
compat_session_id: makeUuid(tokenCreatedAt),
|
||||
user_id: masUser.user_id,
|
||||
device_id: accessToken.device_id,
|
||||
created_at: tokenCreatedAt,
|
||||
is_synapse_admin: user.admin === 1,
|
||||
};
|
||||
log.debug(
|
||||
`${stringifyAndRedact(accessToken)} => ${stringifyAndRedact(
|
||||
masCompatSession,
|
||||
)}`,
|
||||
);
|
||||
executions.push(() =>
|
||||
mas.insert(masCompatSession).into("compat_sessions"),
|
||||
);
|
||||
|
||||
const masCompatAccessToken: MCompatAccessToken = {
|
||||
compat_access_token_id: makeUuid(tokenCreatedAt),
|
||||
compat_session_id: masCompatSession.compat_session_id,
|
||||
access_token: accessToken.token,
|
||||
created_at: tokenCreatedAt,
|
||||
};
|
||||
log.debug(
|
||||
`Access token ${accessToken.id} => ${stringifyAndRedact(
|
||||
masCompatAccessToken,
|
||||
)}`,
|
||||
);
|
||||
executions.push(() =>
|
||||
mas.insert(masCompatAccessToken).into("compat_access_tokens"),
|
||||
);
|
||||
|
||||
if (accessToken.refresh_token_id) {
|
||||
const synapseRefreshToken = await synapse
|
||||
.select("*")
|
||||
.from<SRefreshToken>("refresh_tokens")
|
||||
.where({ id: accessToken.refresh_token_id })
|
||||
.first();
|
||||
if (synapseRefreshToken) {
|
||||
const masCompatRefreshToken: MCompatRefreshToken = {
|
||||
compat_refresh_token_id: makeUuid(tokenCreatedAt),
|
||||
compat_session_id: masCompatSession.compat_session_id,
|
||||
compat_access_token_id:
|
||||
masCompatAccessToken.compat_access_token_id,
|
||||
refresh_token: synapseRefreshToken.token,
|
||||
created_at: tokenCreatedAt,
|
||||
};
|
||||
log.debug(
|
||||
`Refresh token ${synapseRefreshToken.id} => ${stringifyAndRedact(
|
||||
masCompatRefreshToken,
|
||||
)}`,
|
||||
);
|
||||
executions.push(() =>
|
||||
mas.insert(masCompatRefreshToken).into("compat_refresh_tokens"),
|
||||
);
|
||||
} else {
|
||||
warningsForUser += 1;
|
||||
warn(
|
||||
`Unable to locate refresh token ${accessToken.refresh_token_id} for user ${user.name}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (warningsForUser > 0) {
|
||||
if (!args.dryRun) {
|
||||
fatal(`User ${user.name} had ${warningsForUser} warnings`);
|
||||
} else {
|
||||
log.warn(`User ${user.name} had ${warningsForUser} warnings`);
|
||||
}
|
||||
} else if (!args.dryRun) {
|
||||
log.info(`Running ${executions.length} updates for user ${user.name}`);
|
||||
const tx = await mas.transaction();
|
||||
try {
|
||||
for (const execution of executions) {
|
||||
await execution();
|
||||
}
|
||||
await tx.commit();
|
||||
log.info(`Migrated user ${user.name}`);
|
||||
} catch (e) {
|
||||
try {
|
||||
await tx.rollback();
|
||||
} catch (e2) {
|
||||
log.error(`Failed to rollback transaction: ${e2}`);
|
||||
}
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// this is a workaround to get the list of columns that we care about from the SUser type
|
||||
const SUserColumns: Record<keyof SUser, undefined> = {
|
||||
name: undefined,
|
||||
password_hash: undefined,
|
||||
admin: undefined,
|
||||
is_guest: undefined,
|
||||
deactivated: undefined,
|
||||
creation_ts: undefined,
|
||||
appservice_id: undefined,
|
||||
};
|
||||
|
||||
// Get all Synapse users, except appservice owned users who don't need to be migrated
|
||||
const synapseUserQuery = synapse
|
||||
.select(Object.keys(SUserColumns) as (keyof SUser)[])
|
||||
.from<SUser>("users")
|
||||
.whereNull("appservice_id");
|
||||
|
||||
let synapseUsers = 0;
|
||||
if (synapseConfig.database.name === "sqlite3") {
|
||||
// SQLite doesn't support streaming
|
||||
const synapseUserRows = (await synapseUserQuery) as unknown as SUser[];
|
||||
for (const user of synapseUserRows) {
|
||||
synapseUsers += 1;
|
||||
await migrateUser(user);
|
||||
}
|
||||
} else {
|
||||
// Stream users from the database
|
||||
const synapseUserStream = synapseUserQuery.stream();
|
||||
for await (const user of synapseUserStream) {
|
||||
synapseUsers += 1;
|
||||
await migrateUser(user as unknown as SUser);
|
||||
}
|
||||
}
|
||||
|
||||
log.info(
|
||||
`Completed migration ${args.dryRun ? "dry-run " : ""}of ${synapseUsers} users with ${fatals} fatals and ${warnings.length} warnings:`,
|
||||
);
|
||||
for (const w of warnings) log.warn(w);
|
||||
if (fatals > 0) {
|
||||
throw new Error(`Migration failed with ${fatals} fatals`);
|
||||
}
|
||||
}
|
||||
@@ -1,65 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import * as z from "zod";
|
||||
|
||||
const ssl = z
|
||||
.object({
|
||||
ssl_ca: z.string().optional(),
|
||||
ssl_ca_file: z.string().optional(),
|
||||
ssl_certificate: z.string().optional(),
|
||||
ssl_certificate_file: z.string().optional(),
|
||||
ssl_key: z.string().optional(),
|
||||
ssl_key_file: z.string().optional(),
|
||||
})
|
||||
.refine((ssl) => {
|
||||
if (ssl.ssl_ca && ssl.ssl_ca_file) {
|
||||
throw new Error("Cannot specify both ssl_ca and ssl_ca_file");
|
||||
}
|
||||
|
||||
if (ssl.ssl_certificate && ssl.ssl_certificate_file) {
|
||||
throw new Error("Cannot specify both ssl_cert and ssl_cert_file");
|
||||
}
|
||||
|
||||
if (ssl.ssl_key && ssl.ssl_key_file) {
|
||||
throw new Error("Cannot specify both ssl_key and ssl_key_file");
|
||||
}
|
||||
|
||||
return true;
|
||||
});
|
||||
|
||||
const uriDatabaseConfig = z
|
||||
.object({
|
||||
uri: z.string(),
|
||||
})
|
||||
.and(ssl);
|
||||
|
||||
export type URIDatabaseConfig = z.infer<typeof uriDatabaseConfig>;
|
||||
|
||||
const objectDatabaseConfig = z
|
||||
.object({
|
||||
host: z.string().optional(),
|
||||
port: z.number().optional(),
|
||||
username: z.string().optional(),
|
||||
password: z.string().optional(),
|
||||
database: z.string().optional(),
|
||||
})
|
||||
.and(ssl);
|
||||
|
||||
const databaseConfig = z.union([uriDatabaseConfig, objectDatabaseConfig]);
|
||||
|
||||
export type DatabaseConfig = z.infer<typeof databaseConfig>;
|
||||
|
||||
const secretsConfig = z.object({
|
||||
encryption: z.string(),
|
||||
});
|
||||
|
||||
export const masConfig = z.object({
|
||||
database: databaseConfig,
|
||||
secrets: secretsConfig,
|
||||
});
|
||||
|
||||
export type MASConfig = z.infer<typeof masConfig>;
|
||||
@@ -1,96 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import * as z from "zod";
|
||||
|
||||
const sqlite3DatabaseConfig = z.object({
|
||||
name: z.literal("sqlite3"),
|
||||
args: z.object({
|
||||
database: z.string(),
|
||||
}),
|
||||
});
|
||||
|
||||
const psycopg2DatabaseConfig = z.object({
|
||||
name: z.literal("psycopg2"),
|
||||
args: z.object({
|
||||
user: z.string().nullish(),
|
||||
password: z.string().nullish(),
|
||||
database: z.string().nullish(),
|
||||
dbname: z.string().nullish(),
|
||||
host: z.string().nullish(),
|
||||
port: z.union([z.number(), z.string()]).nullish(),
|
||||
sslcert: z.string().nullish(),
|
||||
sslkey: z.string().nullish(),
|
||||
sslpassword: z.string().nullish(),
|
||||
sslrootcert: z.string().nullish(),
|
||||
}),
|
||||
});
|
||||
|
||||
const databaseConfig = z.union([sqlite3DatabaseConfig, psycopg2DatabaseConfig]);
|
||||
|
||||
const oidcProviderConfig = z.object({
|
||||
idp_id: z.string(),
|
||||
idp_name: z.string().nullish(),
|
||||
issuer: z.string(),
|
||||
client_id: z.string(),
|
||||
scopes: z.array(z.string()),
|
||||
client_auth_method: z
|
||||
.union([
|
||||
z.literal("client_secret_basic"),
|
||||
z.literal("client_secret_post"),
|
||||
z.literal("none"),
|
||||
])
|
||||
.nullish(),
|
||||
client_secret: z.string().nullish(),
|
||||
client_secret_jwt_key: z.string().nullish(),
|
||||
});
|
||||
|
||||
export type SynapseOIDCProvider = z.infer<typeof oidcProviderConfig>;
|
||||
|
||||
export const synapseConfig = z.object({
|
||||
database: databaseConfig,
|
||||
oidc_providers: z.array(oidcProviderConfig).nullish(),
|
||||
oidc_config: oidcProviderConfig.nullish(),
|
||||
allow_guest_access: z.boolean().nullish(),
|
||||
cas_config: z
|
||||
.object({
|
||||
enabled: z.boolean().nullish(),
|
||||
})
|
||||
.nullish(),
|
||||
saml2_config: z
|
||||
.object({
|
||||
sp_config: z.object({}).nullish(),
|
||||
})
|
||||
.nullish(),
|
||||
sso: z
|
||||
.object({
|
||||
client_whitelist: z.array(z.string()).nullish(),
|
||||
update_profile_information: z.boolean().nullish(),
|
||||
})
|
||||
.nullish(),
|
||||
jwt_config: z
|
||||
.object({
|
||||
enabled: z.boolean().nullish(),
|
||||
})
|
||||
.nullish(),
|
||||
password_config: z
|
||||
.object({
|
||||
enabled: z.boolean().nullish(),
|
||||
localdb_enabled: z.boolean().nullish(),
|
||||
})
|
||||
.nullish(),
|
||||
enable_registration_captcha: z.boolean().nullish(),
|
||||
enable_registration: z.boolean().nullish(),
|
||||
user_consent: z.object({}).nullish(),
|
||||
enable_3pid_changes: z.boolean().nullish(),
|
||||
login_via_existing_session: z
|
||||
.object({
|
||||
enabled: z.boolean().nullish(),
|
||||
})
|
||||
.nullish(),
|
||||
});
|
||||
|
||||
export type SynapseConfig = z.infer<typeof synapseConfig>;
|
||||
36
tools/syn2mas/src/types/MCompatAccessToken.d.ts
vendored
36
tools/syn2mas/src/types/MCompatAccessToken.d.ts
vendored
@@ -1,36 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import type { MCompatSession } from "./MCompatSession";
|
||||
|
||||
import type { UUID } from "./index";
|
||||
|
||||
/*
|
||||
+------------------------+--------------------------+-----------+
|
||||
| Column | Type | Modifiers |
|
||||
|------------------------+--------------------------+-----------|
|
||||
| compat_access_token_id | uuid | not null |
|
||||
| compat_session_id | uuid | not null |
|
||||
| access_token | text | not null |
|
||||
| created_at | timestamp with time zone | not null |
|
||||
| expires_at | timestamp with time zone | |
|
||||
+------------------------+--------------------------+-----------+
|
||||
Indexes:
|
||||
"compat_access_tokens_pkey" PRIMARY KEY, btree (compat_access_token_id)
|
||||
"compat_access_tokens_access_token_unique" UNIQUE CONSTRAINT, btree (access_token)
|
||||
Foreign-key constraints:
|
||||
"compat_access_tokens_compat_session_id_fkey" FOREIGN KEY (compat_session_id) REFERENCES compat_sessions(compat_session_id)
|
||||
Referenced by:
|
||||
TABLE "compat_refresh_tokens" CONSTRAINT "compat_refresh_tokens_compat_access_token_id_fkey" FOREIGN KEY (compat_access_token_id) REFERENCES compat_access_tokens(compat_access_toke
|
||||
n_id)
|
||||
*/
|
||||
export interface MCompatAccessToken {
|
||||
compat_access_token_id: UUID<MCompatAccessToken>;
|
||||
compat_session_id: UUID<MCompatSession>;
|
||||
access_token: string;
|
||||
created_at: Date;
|
||||
expires_at?: Date;
|
||||
}
|
||||
37
tools/syn2mas/src/types/MCompatRefreshToken.d.ts
vendored
37
tools/syn2mas/src/types/MCompatRefreshToken.d.ts
vendored
@@ -1,37 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import type { MCompatAccessToken } from "./MCompatAccessToken";
|
||||
import type { MCompatSession } from "./MCompatSession";
|
||||
|
||||
import type { UUID } from "./index";
|
||||
|
||||
/*
|
||||
+-------------------------+--------------------------+-----------+
|
||||
| Column | Type | Modifiers |
|
||||
|-------------------------+--------------------------+-----------|
|
||||
| compat_refresh_token_id | uuid | not null |
|
||||
| compat_session_id | uuid | not null |
|
||||
| compat_access_token_id | uuid | not null |
|
||||
| refresh_token | text | not null |
|
||||
| created_at | timestamp with time zone | not null |
|
||||
| consumed_at | timestamp with time zone | |
|
||||
+-------------------------+--------------------------+-----------+
|
||||
Indexes:
|
||||
"compat_refresh_tokens_pkey" PRIMARY KEY, btree (compat_refresh_token_id)
|
||||
"compat_refresh_tokens_refresh_token_unique" UNIQUE CONSTRAINT, btree (refresh_token)
|
||||
Foreign-key constraints:
|
||||
"compat_refresh_tokens_compat_access_token_id_fkey" FOREIGN KEY (compat_access_token_id) REFERENCES compat_access_tokens(compat_access_token_id)
|
||||
"compat_refresh_tokens_compat_session_id_fkey" FOREIGN KEY (compat_session_id) REFERENCES compat_sessions(compat_session_id)
|
||||
*/
|
||||
export interface MCompatRefreshToken {
|
||||
compat_refresh_token_id: UUID<MCompatRefreshToken>;
|
||||
compat_session_id: UUID<MCompatSession>;
|
||||
compat_access_token_id: UUID<MCompatAccessToken>;
|
||||
refresh_token: string;
|
||||
created_at: Date;
|
||||
consumed_at?: Date;
|
||||
}
|
||||
40
tools/syn2mas/src/types/MCompatSession.d.ts
vendored
40
tools/syn2mas/src/types/MCompatSession.d.ts
vendored
@@ -1,40 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import type { MUser } from "./MUser";
|
||||
|
||||
import type { UUID } from "./index";
|
||||
|
||||
/*
|
||||
+-------------------+--------------------------+-----------+
|
||||
| Column | Type | Modifiers |
|
||||
|-------------------+--------------------------+-----------|
|
||||
| compat_session_id | uuid | not null |
|
||||
| user_id | uuid | not null |
|
||||
| device_id | text | not null |
|
||||
| created_at | timestamp with time zone | not null |
|
||||
| finished_at | timestamp with time zone | |
|
||||
| is_synapse_admin | boolean | not null |
|
||||
+-------------------+--------------------------+-----------+
|
||||
Indexes:
|
||||
"compat_sessions_pkey" PRIMARY KEY, btree (compat_session_id)
|
||||
"compat_sessions_device_id_unique" UNIQUE CONSTRAINT, btree (device_id)
|
||||
Foreign-key constraints:
|
||||
"compat_sessions_user_id_fkey" FOREIGN KEY (user_id) REFERENCES users(user_id)
|
||||
Referenced by:
|
||||
TABLE "compat_sso_logins" CONSTRAINT "compat_sso_logins_compat_session_id_fkey" FOREIGN KEY (compat_session_id) REFERENCES compat_sessions(compat_session_id) ON DELETE SET NULL
|
||||
TABLE "compat_access_tokens" CONSTRAINT "compat_access_tokens_compat_session_id_fkey" FOREIGN KEY (compat_session_id) REFERENCES compat_sessions(compat_session_id)
|
||||
TABLE "compat_refresh_tokens" CONSTRAINT "compat_refresh_tokens_compat_session_id_fkey" FOREIGN KEY (compat_session_id) REFERENCES compat_sessions(compat_session_id)
|
||||
*/
|
||||
|
||||
export interface MCompatSession {
|
||||
compat_session_id: UUID<MCompatSession>;
|
||||
user_id: UUID<MUser>;
|
||||
device_id: string;
|
||||
created_at: Date;
|
||||
finished_at?: Date;
|
||||
is_synapse_admin: boolean;
|
||||
}
|
||||
37
tools/syn2mas/src/types/MUpstreamOauthLink.d.ts
vendored
37
tools/syn2mas/src/types/MUpstreamOauthLink.d.ts
vendored
@@ -1,37 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import type { MUpstreamOauthProvider } from "./MUpstreamOauthProvider";
|
||||
import type { MUser } from "./MUser";
|
||||
|
||||
import type { UUID } from "./index";
|
||||
|
||||
/*
|
||||
+----------------------------+--------------------------+-----------+
|
||||
| Column | Type | Modifiers |
|
||||
|----------------------------+--------------------------+-----------|
|
||||
| upstream_oauth_link_id | uuid | not null |
|
||||
| upstream_oauth_provider_id | uuid | not null |
|
||||
| user_id | uuid | |
|
||||
| subject | text | not null |
|
||||
| created_at | timestamp with time zone | not null |
|
||||
+----------------------------+--------------------------+-----------+
|
||||
Indexes:
|
||||
"upstream_oauth_links_pkey" PRIMARY KEY, btree (upstream_oauth_link_id)
|
||||
"upstream_oauth_links_subject_unique" UNIQUE CONSTRAINT, btree (upstream_oauth_provider_id, subject)
|
||||
Foreign-key constraints:
|
||||
"upstream_oauth_link_user_fkey" FOREIGN KEY (user_id) REFERENCES users(user_id)
|
||||
"upstream_oauth_links_provider_fkey" FOREIGN KEY (upstream_oauth_provider_id) REFERENCES upstream_oauth_providers(upstream_oauth_provider_id)
|
||||
Referenced by:
|
||||
TABLE "upstream_oauth_authorization_sessions" CONSTRAINT "upstream_oauth_authorization_sessions_link_fkey" FOREIGN KEY (upstream_oauth_link_id) REFERENCES upstream_oauth_links(upstream_oauth_link_id)
|
||||
*/
|
||||
export interface MUpstreamOauthLink {
|
||||
upstream_oauth_link_id: UUID<MUpstreamOauthLink>;
|
||||
upstream_oauth_provider_id: UUID<MUpstreamOauthProvider>;
|
||||
user_id?: UUID<MUser>;
|
||||
subject: string;
|
||||
created_at: Date;
|
||||
}
|
||||
@@ -1,38 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import type { UUID } from "./index";
|
||||
|
||||
/*
|
||||
+----------------------------+--------------------------+-----------+
|
||||
| Column | Type | Modifiers |
|
||||
|----------------------------+--------------------------+-----------|
|
||||
| upstream_oauth_provider_id | uuid | not null |
|
||||
| issuer | text | not null |
|
||||
| scope | text | not null |
|
||||
| client_id | text | not null |
|
||||
| encrypted_client_secret | text | |
|
||||
| token_endpoint_signing_alg | text | |
|
||||
| token_endpoint_auth_method | text | not null |
|
||||
| created_at | timestamp with time zone | not null |
|
||||
+----------------------------+--------------------------+-----------+
|
||||
Indexes:
|
||||
"upstream_oauth_providers_pkey" PRIMARY KEY, btree (upstream_oauth_provider_id)
|
||||
Referenced by:
|
||||
TABLE "upstream_oauth_links" CONSTRAINT "upstream_oauth_links_provider_fkey" FOREIGN KEY (upstream_oauth_provider_id) REFERENCES upstream_oauth_providers(upstream_oauth_provider_id)
|
||||
TABLE "upstream_oauth_authorization_sessions" CONSTRAINT "upstream_oauth_authorization_sessions_provider_fkey" FOREIGN KEY (upstream_oauth_provider_id) REFERENCES upstream_oauth_providers(upstream_oauth_provider_id)
|
||||
*/
|
||||
|
||||
export interface MUpstreamOauthProvider {
|
||||
upstream_oauth_provider_id: UUID<MUpstreamOauthProvider>;
|
||||
issuer: string;
|
||||
scope: string;
|
||||
client_id: string;
|
||||
encrypted_client_secret?: string;
|
||||
token_endpoint_signing_alg?: string;
|
||||
token_endpoint_auth_method: string;
|
||||
created_at: Date;
|
||||
}
|
||||
17
tools/syn2mas/src/types/MUser.d.ts
vendored
17
tools/syn2mas/src/types/MUser.d.ts
vendored
@@ -1,17 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import type { MUserEmail } from "./MUserEmail";
|
||||
|
||||
import type { UUID } from "./index";
|
||||
|
||||
export interface MUser {
|
||||
user_id: UUID<MUser>;
|
||||
username: string; // localpart only without @
|
||||
created_at: Date;
|
||||
locked_at: Date | null;
|
||||
can_request_admin: boolean;
|
||||
}
|
||||
29
tools/syn2mas/src/types/MUserEmail.d.ts
vendored
29
tools/syn2mas/src/types/MUserEmail.d.ts
vendored
@@ -1,29 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import type { MUser } from "./MUser";
|
||||
|
||||
import type { UUID } from "./index";
|
||||
|
||||
/*
|
||||
+---------------+--------------------------+-----------+
|
||||
| Column | Type | Modifiers |
|
||||
|---------------+--------------------------+-----------|
|
||||
| user_email_id | uuid | not null |
|
||||
| user_id | uuid | not null |
|
||||
| email | text | not null |
|
||||
| created_at | timestamp with time zone | not null |
|
||||
| confirmed_at | timestamp with time zone | |
|
||||
+---------------+--------------------------+-----------+
|
||||
*/
|
||||
|
||||
export interface MUserEmail {
|
||||
user_email_id: UUID<MUserEmail>;
|
||||
user_id: UUID<MUser>;
|
||||
email: string;
|
||||
created_at: Date;
|
||||
confirmed_at?: Date;
|
||||
}
|
||||
18
tools/syn2mas/src/types/MUserPassword.d.ts
vendored
18
tools/syn2mas/src/types/MUserPassword.d.ts
vendored
@@ -1,18 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import type { MUser } from "./MUser";
|
||||
|
||||
import type { UUID } from "./index";
|
||||
|
||||
export interface MUserPassword {
|
||||
user_password_id: UUID<MUserPassword>;
|
||||
user_id: UUID<MUser>;
|
||||
hashed_password: string;
|
||||
created_at: Date;
|
||||
version: number;
|
||||
upgraded_from_id?: UUID<MUserPassword>;
|
||||
}
|
||||
34
tools/syn2mas/src/types/SAccessToken.d.ts
vendored
34
tools/syn2mas/src/types/SAccessToken.d.ts
vendored
@@ -1,34 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import type { SRefreshToken } from "./SRefreshToken";
|
||||
|
||||
import type { Id, SynapseUserId } from "./index";
|
||||
|
||||
/*
|
||||
CREATE TABLE access_tokens (
|
||||
id bigint NOT NULL,
|
||||
user_id text NOT NULL,
|
||||
device_id text,
|
||||
token text NOT NULL,
|
||||
valid_until_ms bigint,
|
||||
puppets_user_id text,
|
||||
last_validated bigint,
|
||||
refresh_token_id bigint,
|
||||
used boolean
|
||||
);
|
||||
*/
|
||||
export interface SAccessToken {
|
||||
id: Id<SAccessToken>;
|
||||
user_id: SynapseUserId;
|
||||
device_id: string;
|
||||
token: string;
|
||||
valid_until_ms?: number;
|
||||
puppets_user_id?: SynapseUserId;
|
||||
last_validated?: number;
|
||||
refresh_token_id?: Id<SRefreshToken>;
|
||||
used: boolean;
|
||||
}
|
||||
30
tools/syn2mas/src/types/SRefreshToken.d.ts
vendored
30
tools/syn2mas/src/types/SRefreshToken.d.ts
vendored
@@ -1,30 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import type { Id, SynapseUserId } from "./index";
|
||||
|
||||
/*
|
||||
);
|
||||
CREATE TABLE refresh_tokens (
|
||||
id bigint NOT NULL,
|
||||
user_id text NOT NULL,
|
||||
device_id text NOT NULL,
|
||||
token text NOT NULL,
|
||||
next_token_id bigint,
|
||||
expiry_ts bigint,
|
||||
ultimate_session_expiry_ts bigint
|
||||
);
|
||||
*/
|
||||
|
||||
export interface SRefreshToken {
|
||||
id: Id<SRefreshToken>;
|
||||
user_id: SynapseUserId;
|
||||
device_id: string;
|
||||
token: string;
|
||||
next_token_id?: number; // refresh or access?
|
||||
expiry_ts?: number;
|
||||
ultimate_session_expiry_ts?: number;
|
||||
}
|
||||
17
tools/syn2mas/src/types/SUser.d.ts
vendored
17
tools/syn2mas/src/types/SUser.d.ts
vendored
@@ -1,17 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import type { SynapseUserId, UnixTimestamp } from "./index";
|
||||
|
||||
export interface SUser {
|
||||
name: SynapseUserId; // '@test2:localhost:8008'
|
||||
password_hash?: string;
|
||||
admin: number;
|
||||
is_guest: number;
|
||||
deactivated: number;
|
||||
creation_ts: UnixTimestamp;
|
||||
appservice_id?: string;
|
||||
}
|
||||
13
tools/syn2mas/src/types/SUserExternalId.d.ts
vendored
13
tools/syn2mas/src/types/SUserExternalId.d.ts
vendored
@@ -1,13 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import type { SynapseUserId } from "./index";
|
||||
|
||||
export interface SUserExternalId {
|
||||
auth_provider: string;
|
||||
external_id: string;
|
||||
user_id: SynapseUserId;
|
||||
}
|
||||
24
tools/syn2mas/src/types/SUserThreePid.d.ts
vendored
24
tools/syn2mas/src/types/SUserThreePid.d.ts
vendored
@@ -1,24 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import type { SynapseUserId } from "./index";
|
||||
|
||||
/*
|
||||
CREATE TABLE user_threepids (
|
||||
user_id text NOT NULL,
|
||||
medium text NOT NULL,
|
||||
address text NOT NULL,
|
||||
validated_at bigint NOT NULL,
|
||||
added_at bigint NOT NULL
|
||||
);
|
||||
*/
|
||||
export interface SUserThreePid {
|
||||
user_id: SynapseUserId;
|
||||
medium: string;
|
||||
address: string;
|
||||
validated_at: number;
|
||||
added_at: number;
|
||||
}
|
||||
12
tools/syn2mas/src/types/index.d.ts
vendored
12
tools/syn2mas/src/types/index.d.ts
vendored
@@ -1,12 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
export type UnixTimestamp = number;
|
||||
export type SynapseUserId = string;
|
||||
// eslint-disable-next-line @typescript-eslint/no-unused-vars
|
||||
export type Id<_T> = number;
|
||||
// eslint-disable-next-line @typescript-eslint/no-unused-vars
|
||||
export type UUID<_T> = string;
|
||||
13
tools/syn2mas/src/types/knex.d.ts
vendored
13
tools/syn2mas/src/types/knex.d.ts
vendored
@@ -1,13 +0,0 @@
|
||||
// Copyright 2024 New Vector Ltd.
|
||||
// Copyright 2023, 2024 The Matrix.org Foundation C.I.C.
|
||||
//
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Please see LICENSE in the repository root for full details.
|
||||
|
||||
import "knex/types/result";
|
||||
|
||||
declare module "knex/types/result" {
|
||||
interface Registry {
|
||||
Count: number;
|
||||
}
|
||||
}
|
||||
@@ -1,11 +0,0 @@
|
||||
{
|
||||
"extends": [
|
||||
"@tsconfig/strictest/tsconfig.json",
|
||||
"@tsconfig/node22/tsconfig.json"
|
||||
],
|
||||
"compilerOptions": {
|
||||
"noEmit": true,
|
||||
"allowJs": true
|
||||
},
|
||||
"include": [".eslintrc.cjs", "src/**/*.mts", "src/**/*.ts"]
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
{
|
||||
"extends": [
|
||||
"@tsconfig/strictest/tsconfig.json",
|
||||
"@tsconfig/node22/tsconfig.json"
|
||||
],
|
||||
"compilerOptions": {
|
||||
"outDir": "dist",
|
||||
"rootDir": "src",
|
||||
"sourceMap": true,
|
||||
"declaration": false
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user